CVE-2025-38443

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> nbd: fix uaf in nbd_genl_connect() error path<br /> <br /> There is a use-after-free issue in nbd:<br /> <br /> block nbd6: Receive control failed (result -104)<br /> block nbd6: shutting down sockets<br /> ==================================================================<br /> BUG: KASAN: slab-use-after-free in recv_work+0x694/0xa80 drivers/block/nbd.c:1022<br /> Write of size 4 at addr ffff8880295de478 by task kworker/u33:0/67<br /> <br /> CPU: 2 UID: 0 PID: 67 Comm: kworker/u33:0 Not tainted 6.15.0-rc5-syzkaller-00123-g2c89c1b655c0 #0 PREEMPT(full)<br /> Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014<br /> Workqueue: nbd6-recv recv_work<br /> Call Trace:<br /> <br /> __dump_stack lib/dump_stack.c:94 [inline]<br /> dump_stack_lvl+0x116/0x1f0 lib/dump_stack.c:120<br /> print_address_description mm/kasan/report.c:408 [inline]<br /> print_report+0xc3/0x670 mm/kasan/report.c:521<br /> kasan_report+0xe0/0x110 mm/kasan/report.c:634<br /> check_region_inline mm/kasan/generic.c:183 [inline]<br /> kasan_check_range+0xef/0x1a0 mm/kasan/generic.c:189<br /> instrument_atomic_read_write include/linux/instrumented.h:96 [inline]<br /> atomic_dec include/linux/atomic/atomic-instrumented.h:592 [inline]<br /> recv_work+0x694/0xa80 drivers/block/nbd.c:1022<br /> process_one_work+0x9cc/0x1b70 kernel/workqueue.c:3238<br /> process_scheduled_works kernel/workqueue.c:3319 [inline]<br /> worker_thread+0x6c8/0xf10 kernel/workqueue.c:3400<br /> kthread+0x3c2/0x780 kernel/kthread.c:464<br /> ret_from_fork+0x45/0x80 arch/x86/kernel/process.c:153<br /> ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245<br /> <br /> <br /> nbd_genl_connect() does not properly stop the device on certain<br /> error paths after nbd_start_device() has been called. This causes<br /> the error path to put nbd-&gt;config while recv_work continue to use<br /> the config after putting it, leading to use-after-free in recv_work.<br /> <br /> This patch moves nbd_start_device() after the backend file creation.