GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2025-68372 (GCVE-0-2025-68372)

Vulnerability from cvelistv5 – Published: 2025-12-24 10:33 – Updated: 2026-06-16 19:28
VLAI
Title
nbd: defer config put in recv_work
Summary
In the Linux kernel, the following vulnerability has been resolved: nbd: defer config put in recv_work There is one uaf issue in recv_work when running NBD_CLEAR_SOCK and NBD_CMD_RECONFIGURE: nbd_genl_connect // conf_ref=2 (connect and recv_work A) nbd_open // conf_ref=3 recv_work A done // conf_ref=2 NBD_CLEAR_SOCK // conf_ref=1 nbd_genl_reconfigure // conf_ref=2 (trigger recv_work B) close nbd // conf_ref=1 recv_work B config_put // conf_ref=0 atomic_dec(&config->recv_threads); -> UAF Or only running NBD_CLEAR_SOCK: nbd_genl_connect // conf_ref=2 nbd_open // conf_ref=3 NBD_CLEAR_SOCK // conf_ref=2 close nbd nbd_release config_put // conf_ref=1 recv_work config_put // conf_ref=0 atomic_dec(&config->recv_threads); -> UAF Commit 87aac3a80af5 ("nbd: call nbd_config_put() before notifying the waiter") moved nbd_config_put() to run before waking up the waiter in recv_work, in order to ensure that nbd_start_device_ioctl() would not be woken up while nbd->task_recv was still uncleared. However, in nbd_start_device_ioctl(), after being woken up it explicitly calls flush_workqueue() to make sure all current works are finished. Therefore, there is no need to move the config put ahead of the wakeup. Move nbd_config_put() to the end of recv_work, so that the reference is held for the whole lifetime of the worker thread. This makes sure the config cannot be freed while recv_work is still running, even if clear + reconfigure interleave. In addition, we don't need to worry about recv_work dropping the last nbd_put (which causes deadlock): path A (netlink with NBD_CFLAG_DESTROY_ON_DISCONNECT): connect // nbd_refs=1 (trigger recv_work) open nbd // nbd_refs=2 NBD_CLEAR_SOCK close nbd nbd_release nbd_disconnect_and_put flush_workqueue // recv_work done nbd_config_put nbd_put // nbd_refs=1 nbd_put // nbd_refs=0 queue_work path B (netlink without NBD_CFLAG_DESTROY_ON_DISCONNECT): connect // nbd_refs=2 (trigger recv_work) open nbd // nbd_refs=3 NBD_CLEAR_SOCK // conf_refs=2 close nbd nbd_release nbd_config_put // conf_refs=1 nbd_put // nbd_refs=2 recv_work done // conf_refs=0, nbd_refs=1 rmmod // nbd_refs=0 Depends-on: e2daec488c57 ("nbd: Fix hungtask when nbd_config_put")
Severity
No CVSS data available.
SSVC
Exploitation: none Automatable: no Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-06-16 19:28 UTC
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 87aac3a80af5cbad93e63250e8a1e19095ba0d30 , < 198aa230a6f8c1f6af7ed26b29180749c3e79e4d (git)
Affected: 87aac3a80af5cbad93e63250e8a1e19095ba0d30 , < d3ba312675911ff9e3fefefd551751e153a9f0a9 (git)
Affected: 87aac3a80af5cbad93e63250e8a1e19095ba0d30 , < 3692884bd6187d89d41eef81e5a9724519fd01c1 (git)
Affected: 87aac3a80af5cbad93e63250e8a1e19095ba0d30 , < 1ba2ced2bbdf7e64a30c3e88c70ea8bc208d1509 (git)
Affected: 87aac3a80af5cbad93e63250e8a1e19095ba0d30 , < 6b69593f72e1bfba6ca47ca8d9b619341fded7d6 (git)
Affected: 87aac3a80af5cbad93e63250e8a1e19095ba0d30 , < 443a1721806b6ff6303b5229e9811d68172d622f (git)
Affected: 87aac3a80af5cbad93e63250e8a1e19095ba0d30 , < 742012f6bf29553fdc460bf646a58df3a7b43d01 (git)
Affected: 87aac3a80af5cbad93e63250e8a1e19095ba0d30 , < 9517b82d8d422d426a988b213fdd45c6b417b86d (git)
Affected: 0a4e383fc3aa6540f804c4fd1184a96ae5de6ef8 (git)
Affected: 2ef6f4bd60411934e3fc2715442c2afe70f84bf3 (git)
Affected: 742fd49cf811ca164489e339b862e3fb8e240a73 (git)
Affected: 14df8724aeeef338172e2a2d6efadc989921ca0f (git)
Affected: 4.14.204 , < 4.15 (semver)
Affected: 4.19.155 , < 4.20 (semver)
Affected: 5.4.75 , < 5.5 (semver)
Affected: 5.9.5 , < 5.10 (semver)
guessed Create a notification for this product.
Linux Linux Affected: 5.10
Unaffected: 0 , < 5.10 (semver)
Unaffected: 5.10.248 , ≤ 5.10.* (semver)
Unaffected: 5.15.198 , ≤ 5.15.* (semver)
Unaffected: 6.1.160 , ≤ 6.1.* (semver)
Unaffected: 6.6.120 , ≤ 6.6.* (semver)
Unaffected: 6.12.63 , ≤ 6.12.* (semver)
Unaffected: 6.17.13 , ≤ 6.17.* (semver)
Unaffected: 6.18.2 , ≤ 6.18.* (semver)
Unaffected: 6.19 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-68372",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-06-16T19:28:28.671225Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-06-16T19:28:42.649Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/block/nbd.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "198aa230a6f8c1f6af7ed26b29180749c3e79e4d",
              "status": "affected",
              "version": "87aac3a80af5cbad93e63250e8a1e19095ba0d30",
              "versionType": "git"
            },
            {
              "lessThan": "d3ba312675911ff9e3fefefd551751e153a9f0a9",
              "status": "affected",
              "version": "87aac3a80af5cbad93e63250e8a1e19095ba0d30",
              "versionType": "git"
            },
            {
              "lessThan": "3692884bd6187d89d41eef81e5a9724519fd01c1",
              "status": "affected",
              "version": "87aac3a80af5cbad93e63250e8a1e19095ba0d30",
              "versionType": "git"
            },
            {
              "lessThan": "1ba2ced2bbdf7e64a30c3e88c70ea8bc208d1509",
              "status": "affected",
              "version": "87aac3a80af5cbad93e63250e8a1e19095ba0d30",
              "versionType": "git"
            },
            {
              "lessThan": "6b69593f72e1bfba6ca47ca8d9b619341fded7d6",
              "status": "affected",
              "version": "87aac3a80af5cbad93e63250e8a1e19095ba0d30",
              "versionType": "git"
            },
            {
              "lessThan": "443a1721806b6ff6303b5229e9811d68172d622f",
              "status": "affected",
              "version": "87aac3a80af5cbad93e63250e8a1e19095ba0d30",
              "versionType": "git"
            },
            {
              "lessThan": "742012f6bf29553fdc460bf646a58df3a7b43d01",
              "status": "affected",
              "version": "87aac3a80af5cbad93e63250e8a1e19095ba0d30",
              "versionType": "git"
            },
            {
              "lessThan": "9517b82d8d422d426a988b213fdd45c6b417b86d",
              "status": "affected",
              "version": "87aac3a80af5cbad93e63250e8a1e19095ba0d30",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "0a4e383fc3aa6540f804c4fd1184a96ae5de6ef8",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "2ef6f4bd60411934e3fc2715442c2afe70f84bf3",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "742fd49cf811ca164489e339b862e3fb8e240a73",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "14df8724aeeef338172e2a2d6efadc989921ca0f",
              "versionType": "git"
            },
            {
              "lessThan": "4.15",
              "status": "affected",
              "version": "4.14.204",
              "versionType": "semver"
            },
            {
              "lessThan": "4.20",
              "status": "affected",
              "version": "4.19.155",
              "versionType": "semver"
            },
            {
              "lessThan": "5.5",
              "status": "affected",
              "version": "5.4.75",
              "versionType": "semver"
            },
            {
              "lessThan": "5.10",
              "status": "affected",
              "version": "5.9.5",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/block/nbd.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.10"
            },
            {
              "lessThan": "5.10",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.248",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.198",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.160",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.120",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.63",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.17.*",
              "status": "unaffected",
              "version": "6.17.13",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.2",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.19",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.248",
                  "versionStartIncluding": "5.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.198",
                  "versionStartIncluding": "5.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.160",
                  "versionStartIncluding": "5.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.120",
                  "versionStartIncluding": "5.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.63",
                  "versionStartIncluding": "5.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.17.13",
                  "versionStartIncluding": "5.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.2",
                  "versionStartIncluding": "5.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.19",
                  "versionStartIncluding": "5.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "4.14.204",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "4.19.155",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "5.4.75",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "5.9.5",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnbd: defer config put in recv_work\n\nThere is one uaf issue in recv_work when running NBD_CLEAR_SOCK and\nNBD_CMD_RECONFIGURE:\n  nbd_genl_connect     // conf_ref=2 (connect and recv_work A)\n  nbd_open\t       // conf_ref=3\n  recv_work A done     // conf_ref=2\n  NBD_CLEAR_SOCK       // conf_ref=1\n  nbd_genl_reconfigure // conf_ref=2 (trigger recv_work B)\n  close nbd\t       // conf_ref=1\n  recv_work B\n    config_put         // conf_ref=0\n    atomic_dec(\u0026config-\u003erecv_threads); -\u003e UAF\n\nOr only running NBD_CLEAR_SOCK:\n  nbd_genl_connect   // conf_ref=2\n  nbd_open \t     // conf_ref=3\n  NBD_CLEAR_SOCK     // conf_ref=2\n  close nbd\n    nbd_release\n      config_put     // conf_ref=1\n  recv_work\n    config_put \t     // conf_ref=0\n    atomic_dec(\u0026config-\u003erecv_threads); -\u003e UAF\n\nCommit 87aac3a80af5 (\"nbd: call nbd_config_put() before notifying the\nwaiter\") moved nbd_config_put() to run before waking up the waiter in\nrecv_work, in order to ensure that nbd_start_device_ioctl() would not\nbe woken up while nbd-\u003etask_recv was still uncleared.\n\nHowever, in nbd_start_device_ioctl(), after being woken up it explicitly\ncalls flush_workqueue() to make sure all current works are finished.\nTherefore, there is no need to move the config put ahead of the wakeup.\n\nMove nbd_config_put() to the end of recv_work, so that the reference is\nheld for the whole lifetime of the worker thread. This makes sure the\nconfig cannot be freed while recv_work is still running, even if clear\n+ reconfigure interleave.\n\nIn addition, we don\u0027t need to worry about recv_work dropping the last\nnbd_put (which causes deadlock):\n\npath A (netlink with NBD_CFLAG_DESTROY_ON_DISCONNECT):\n  connect  // nbd_refs=1 (trigger recv_work)\n  open nbd // nbd_refs=2\n  NBD_CLEAR_SOCK\n  close nbd\n    nbd_release\n      nbd_disconnect_and_put\n        flush_workqueue // recv_work done\n      nbd_config_put\n        nbd_put // nbd_refs=1\n      nbd_put // nbd_refs=0\n        queue_work\n\npath B (netlink without NBD_CFLAG_DESTROY_ON_DISCONNECT):\n  connect  // nbd_refs=2 (trigger recv_work)\n  open nbd // nbd_refs=3\n  NBD_CLEAR_SOCK // conf_refs=2\n  close nbd\n    nbd_release\n      nbd_config_put // conf_refs=1\n      nbd_put // nbd_refs=2\n  recv_work done // conf_refs=0, nbd_refs=1\n  rmmod // nbd_refs=0\n\nDepends-on: e2daec488c57 (\"nbd: Fix hungtask when nbd_config_put\")"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-23T16:02:46.914Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/198aa230a6f8c1f6af7ed26b29180749c3e79e4d"
        },
        {
          "url": "https://git.kernel.org/stable/c/d3ba312675911ff9e3fefefd551751e153a9f0a9"
        },
        {
          "url": "https://git.kernel.org/stable/c/3692884bd6187d89d41eef81e5a9724519fd01c1"
        },
        {
          "url": "https://git.kernel.org/stable/c/1ba2ced2bbdf7e64a30c3e88c70ea8bc208d1509"
        },
        {
          "url": "https://git.kernel.org/stable/c/6b69593f72e1bfba6ca47ca8d9b619341fded7d6"
        },
        {
          "url": "https://git.kernel.org/stable/c/443a1721806b6ff6303b5229e9811d68172d622f"
        },
        {
          "url": "https://git.kernel.org/stable/c/742012f6bf29553fdc460bf646a58df3a7b43d01"
        },
        {
          "url": "https://git.kernel.org/stable/c/9517b82d8d422d426a988b213fdd45c6b417b86d"
        }
      ],
      "title": "nbd: defer config put in recv_work",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-68372",
    "datePublished": "2025-12-24T10:33:02.679Z",
    "dateReserved": "2025-12-16T14:48:05.310Z",
    "dateUpdated": "2026-06-16T19:28:42.649Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2025-68372",
      "date": "2026-09-16",
      "epss": "0.00193",
      "percentile": "0.09255"
    },
    "microsoft_vex": {
      "current_release_date": "2026-02-18T02:32:55.000Z",
      "cve": "CVE-2025-68372",
      "id": "msrc_CVE-2025-68372",
      "initial_release_date": "2025-12-02T00:00:00.000Z",
      "product_status:fixed": "1",
      "product_status:known_affected": "3",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "nbd: defer config put in recv_work",
      "url": "https://msrc.microsoft.com/csaf/vex/2025/msrc_cve-2025-68372.json",
      "version": "5"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2025-68372\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2025-12-24T11:16:00.777\",\"lastModified\":\"2026-06-17T09:59:01.167\",\"vulnStatus\":\"Deferred\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nnbd: defer config put in recv_work\\n\\nThere is one uaf issue in recv_work when running NBD_CLEAR_SOCK and\\nNBD_CMD_RECONFIGURE:\\n  nbd_genl_connect     // conf_ref=2 (connect and recv_work A)\\n  nbd_open\\t       // conf_ref=3\\n  recv_work A done     // conf_ref=2\\n  NBD_CLEAR_SOCK       // conf_ref=1\\n  nbd_genl_reconfigure // conf_ref=2 (trigger recv_work B)\\n  close nbd\\t       // conf_ref=1\\n  recv_work B\\n    config_put         // conf_ref=0\\n    atomic_dec(\u0026config-\u003erecv_threads); -\u003e UAF\\n\\nOr only running NBD_CLEAR_SOCK:\\n  nbd_genl_connect   // conf_ref=2\\n  nbd_open \\t     // conf_ref=3\\n  NBD_CLEAR_SOCK     // conf_ref=2\\n  close nbd\\n    nbd_release\\n      config_put     // conf_ref=1\\n  recv_work\\n    config_put \\t     // conf_ref=0\\n    atomic_dec(\u0026config-\u003erecv_threads); -\u003e UAF\\n\\nCommit 87aac3a80af5 (\\\"nbd: call nbd_config_put() before notifying the\\nwaiter\\\") moved nbd_config_put() to run before waking up the waiter in\\nrecv_work, in order to ensure that nbd_start_device_ioctl() would not\\nbe woken up while nbd-\u003etask_recv was still uncleared.\\n\\nHowever, in nbd_start_device_ioctl(), after being woken up it explicitly\\ncalls flush_workqueue() to make sure all current works are finished.\\nTherefore, there is no need to move the config put ahead of the wakeup.\\n\\nMove nbd_config_put() to the end of recv_work, so that the reference is\\nheld for the whole lifetime of the worker thread. This makes sure the\\nconfig cannot be freed while recv_work is still running, even if clear\\n+ reconfigure interleave.\\n\\nIn addition, we don\u0027t need to worry about recv_work dropping the last\\nnbd_put (which causes deadlock):\\n\\npath A (netlink with NBD_CFLAG_DESTROY_ON_DISCONNECT):\\n  connect  // nbd_refs=1 (trigger recv_work)\\n  open nbd // nbd_refs=2\\n  NBD_CLEAR_SOCK\\n  close nbd\\n    nbd_release\\n      nbd_disconnect_and_put\\n        flush_workqueue // recv_work done\\n      nbd_config_put\\n        nbd_put // nbd_refs=1\\n      nbd_put // nbd_refs=0\\n        queue_work\\n\\npath B (netlink without NBD_CFLAG_DESTROY_ON_DISCONNECT):\\n  connect  // nbd_refs=2 (trigger recv_work)\\n  open nbd // nbd_refs=3\\n  NBD_CLEAR_SOCK // conf_refs=2\\n  close nbd\\n    nbd_release\\n      nbd_config_put // conf_refs=1\\n      nbd_put // nbd_refs=2\\n  recv_work done // conf_refs=0, nbd_refs=1\\n  rmmod // nbd_refs=0\\n\\nDepends-on: e2daec488c57 (\\\"nbd: Fix hungtask when nbd_config_put\\\")\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"drivers/block/nbd.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"87aac3a80af5cbad93e63250e8a1e19095ba0d30\",\"lessThan\":\"198aa230a6f8c1f6af7ed26b29180749c3e79e4d\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"87aac3a80af5cbad93e63250e8a1e19095ba0d30\",\"lessThan\":\"d3ba312675911ff9e3fefefd551751e153a9f0a9\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"87aac3a80af5cbad93e63250e8a1e19095ba0d30\",\"lessThan\":\"3692884bd6187d89d41eef81e5a9724519fd01c1\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"87aac3a80af5cbad93e63250e8a1e19095ba0d30\",\"lessThan\":\"1ba2ced2bbdf7e64a30c3e88c70ea8bc208d1509\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"87aac3a80af5cbad93e63250e8a1e19095ba0d30\",\"lessThan\":\"6b69593f72e1bfba6ca47ca8d9b619341fded7d6\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"87aac3a80af5cbad93e63250e8a1e19095ba0d30\",\"lessThan\":\"443a1721806b6ff6303b5229e9811d68172d622f\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"87aac3a80af5cbad93e63250e8a1e19095ba0d30\",\"lessThan\":\"742012f6bf29553fdc460bf646a58df3a7b43d01\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"87aac3a80af5cbad93e63250e8a1e19095ba0d30\",\"lessThan\":\"9517b82d8d422d426a988b213fdd45c6b417b86d\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"0a4e383fc3aa6540f804c4fd1184a96ae5de6ef8\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"2ef6f4bd60411934e3fc2715442c2afe70f84bf3\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"742fd49cf811ca164489e339b862e3fb8e240a73\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"14df8724aeeef338172e2a2d6efadc989921ca0f\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"4.14.204\",\"lessThan\":\"4.15\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"4.19.155\",\"lessThan\":\"4.20\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"5.4.75\",\"lessThan\":\"5.5\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"5.9.5\",\"lessThan\":\"5.10\",\"versionType\":\"semver\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"drivers/block/nbd.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"5.10\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"5.10\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.10.248\",\"lessThanOrEqual\":\"5.10.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.15.198\",\"lessThanOrEqual\":\"5.15.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.1.160\",\"lessThanOrEqual\":\"6.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.6.120\",\"lessThanOrEqual\":\"6.6.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.12.63\",\"lessThanOrEqual\":\"6.12.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.17.13\",\"lessThanOrEqual\":\"6.17.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.18.2\",\"lessThanOrEqual\":\"6.18.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.19\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2026-06-16T19:28:28.671225Z\",\"id\":\"CVE-2025-68372\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"partial\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/198aa230a6f8c1f6af7ed26b29180749c3e79e4d\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/1ba2ced2bbdf7e64a30c3e88c70ea8bc208d1509\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/3692884bd6187d89d41eef81e5a9724519fd01c1\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/443a1721806b6ff6303b5229e9811d68172d622f\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/6b69593f72e1bfba6ca47ca8d9b619341fded7d6\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/742012f6bf29553fdc460bf646a58df3a7b43d01\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/9517b82d8d422d426a988b213fdd45c6b417b86d\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/d3ba312675911ff9e3fefefd551751e153a9f0a9\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-06-30T01:53:04+00:00",
      "cve": "CVE-2025-68372",
      "id": "CVE-2025-68372",
      "initial_release_date": "2025-12-24T00:00:00+00:00",
      "product_status:known_affected": "246",
      "product_status:known_not_affected": "28",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: nbd: defer config put in recv_work",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-68372.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-08-28T16:49:30Z",
      "cve": "CVE-2025-68372",
      "id": "CVE-2025-68372",
      "initial_release_date": "2025-12-25T00:24:12Z",
      "product_status:first_fixed": "2",
      "product_status:known_affected": "662",
      "product_status:known_not_affected": "155",
      "product_status:recommended": "318",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2025-68372",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2025-68372.json",
      "version": "31"
    },
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2025-68372\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-06-16T19:28:28.671225Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-06-16T19:28:37.655Z\"}}], \"cna\": {\"title\": \"nbd: defer config put in recv_work\", \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"87aac3a80af5cbad93e63250e8a1e19095ba0d30\", \"lessThan\": \"198aa230a6f8c1f6af7ed26b29180749c3e79e4d\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"87aac3a80af5cbad93e63250e8a1e19095ba0d30\", \"lessThan\": \"d3ba312675911ff9e3fefefd551751e153a9f0a9\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"87aac3a80af5cbad93e63250e8a1e19095ba0d30\", \"lessThan\": \"3692884bd6187d89d41eef81e5a9724519fd01c1\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"87aac3a80af5cbad93e63250e8a1e19095ba0d30\", \"lessThan\": \"1ba2ced2bbdf7e64a30c3e88c70ea8bc208d1509\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"87aac3a80af5cbad93e63250e8a1e19095ba0d30\", \"lessThan\": \"6b69593f72e1bfba6ca47ca8d9b619341fded7d6\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"87aac3a80af5cbad93e63250e8a1e19095ba0d30\", \"lessThan\": \"443a1721806b6ff6303b5229e9811d68172d622f\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"87aac3a80af5cbad93e63250e8a1e19095ba0d30\", \"lessThan\": \"742012f6bf29553fdc460bf646a58df3a7b43d01\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"87aac3a80af5cbad93e63250e8a1e19095ba0d30\", \"lessThan\": \"9517b82d8d422d426a988b213fdd45c6b417b86d\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"0a4e383fc3aa6540f804c4fd1184a96ae5de6ef8\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"2ef6f4bd60411934e3fc2715442c2afe70f84bf3\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"742fd49cf811ca164489e339b862e3fb8e240a73\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"14df8724aeeef338172e2a2d6efadc989921ca0f\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"4.14.204\", \"lessThan\": \"4.15\", \"versionType\": \"semver\"}, {\"status\": \"affected\", \"version\": \"4.19.155\", \"lessThan\": \"4.20\", \"versionType\": \"semver\"}, {\"status\": \"affected\", \"version\": \"5.4.75\", \"lessThan\": \"5.5\", \"versionType\": \"semver\"}, {\"status\": \"affected\", \"version\": \"5.9.5\", \"lessThan\": \"5.10\", \"versionType\": \"semver\"}], \"programFiles\": [\"drivers/block/nbd.c\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"5.10\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"5.10\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"5.10.248\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.10.*\"}, {\"status\": \"unaffected\", \"version\": \"5.15.198\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.15.*\"}, {\"status\": \"unaffected\", \"version\": \"6.1.160\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.1.*\"}, {\"status\": \"unaffected\", \"version\": \"6.6.120\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.6.*\"}, {\"status\": \"unaffected\", \"version\": \"6.12.63\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.12.*\"}, {\"status\": \"unaffected\", \"version\": \"6.17.13\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.17.*\"}, {\"status\": \"unaffected\", \"version\": \"6.18.2\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.18.*\"}, {\"status\": \"unaffected\", \"version\": \"6.19\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"drivers/block/nbd.c\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/198aa230a6f8c1f6af7ed26b29180749c3e79e4d\"}, {\"url\": \"https://git.kernel.org/stable/c/d3ba312675911ff9e3fefefd551751e153a9f0a9\"}, {\"url\": \"https://git.kernel.org/stable/c/3692884bd6187d89d41eef81e5a9724519fd01c1\"}, {\"url\": \"https://git.kernel.org/stable/c/1ba2ced2bbdf7e64a30c3e88c70ea8bc208d1509\"}, {\"url\": \"https://git.kernel.org/stable/c/6b69593f72e1bfba6ca47ca8d9b619341fded7d6\"}, {\"url\": \"https://git.kernel.org/stable/c/443a1721806b6ff6303b5229e9811d68172d622f\"}, {\"url\": \"https://git.kernel.org/stable/c/742012f6bf29553fdc460bf646a58df3a7b43d01\"}, {\"url\": \"https://git.kernel.org/stable/c/9517b82d8d422d426a988b213fdd45c6b417b86d\"}], \"x_generator\": {\"engine\": \"bippy-1.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nnbd: defer config put in recv_work\\n\\nThere is one uaf issue in recv_work when running NBD_CLEAR_SOCK and\\nNBD_CMD_RECONFIGURE:\\n  nbd_genl_connect     // conf_ref=2 (connect and recv_work A)\\n  nbd_open\\t       // conf_ref=3\\n  recv_work A done     // conf_ref=2\\n  NBD_CLEAR_SOCK       // conf_ref=1\\n  nbd_genl_reconfigure // conf_ref=2 (trigger recv_work B)\\n  close nbd\\t       // conf_ref=1\\n  recv_work B\\n    config_put         // conf_ref=0\\n    atomic_dec(\u0026config-\u003erecv_threads); -\u003e UAF\\n\\nOr only running NBD_CLEAR_SOCK:\\n  nbd_genl_connect   // conf_ref=2\\n  nbd_open \\t     // conf_ref=3\\n  NBD_CLEAR_SOCK     // conf_ref=2\\n  close nbd\\n    nbd_release\\n      config_put     // conf_ref=1\\n  recv_work\\n    config_put \\t     // conf_ref=0\\n    atomic_dec(\u0026config-\u003erecv_threads); -\u003e UAF\\n\\nCommit 87aac3a80af5 (\\\"nbd: call nbd_config_put() before notifying the\\nwaiter\\\") moved nbd_config_put() to run before waking up the waiter in\\nrecv_work, in order to ensure that nbd_start_device_ioctl() would not\\nbe woken up while nbd-\u003etask_recv was still uncleared.\\n\\nHowever, in nbd_start_device_ioctl(), after being woken up it explicitly\\ncalls flush_workqueue() to make sure all current works are finished.\\nTherefore, there is no need to move the config put ahead of the wakeup.\\n\\nMove nbd_config_put() to the end of recv_work, so that the reference is\\nheld for the whole lifetime of the worker thread. This makes sure the\\nconfig cannot be freed while recv_work is still running, even if clear\\n+ reconfigure interleave.\\n\\nIn addition, we don\u0027t need to worry about recv_work dropping the last\\nnbd_put (which causes deadlock):\\n\\npath A (netlink with NBD_CFLAG_DESTROY_ON_DISCONNECT):\\n  connect  // nbd_refs=1 (trigger recv_work)\\n  open nbd // nbd_refs=2\\n  NBD_CLEAR_SOCK\\n  close nbd\\n    nbd_release\\n      nbd_disconnect_and_put\\n        flush_workqueue // recv_work done\\n      nbd_config_put\\n        nbd_put // nbd_refs=1\\n      nbd_put // nbd_refs=0\\n        queue_work\\n\\npath B (netlink without NBD_CFLAG_DESTROY_ON_DISCONNECT):\\n  connect  // nbd_refs=2 (trigger recv_work)\\n  open nbd // nbd_refs=3\\n  NBD_CLEAR_SOCK // conf_refs=2\\n  close nbd\\n    nbd_release\\n      nbd_config_put // conf_refs=1\\n      nbd_put // nbd_refs=2\\n  recv_work done // conf_refs=0, nbd_refs=1\\n  rmmod // nbd_refs=0\\n\\nDepends-on: e2daec488c57 (\\\"nbd: Fix hungtask when nbd_config_put\\\")\"}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.10.248\", \"versionStartIncluding\": \"5.10\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.15.198\", \"versionStartIncluding\": \"5.10\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.1.160\", \"versionStartIncluding\": \"5.10\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.6.120\", \"versionStartIncluding\": \"5.10\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.12.63\", \"versionStartIncluding\": \"5.10\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.17.13\", \"versionStartIncluding\": \"5.10\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.18.2\", \"versionStartIncluding\": \"5.10\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.19\", \"versionStartIncluding\": \"5.10\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionStartIncluding\": \"4.14.204\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionStartIncluding\": \"4.19.155\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionStartIncluding\": \"5.4.75\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionStartIncluding\": \"5.9.5\"}], \"operator\": \"OR\"}]}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2026-05-23T16:02:46.914Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2025-68372\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-06-16T19:28:42.649Z\", \"dateReserved\": \"2025-12-16T14:48:05.310Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2025-12-24T10:33:02.679Z\", \"assignerShortName\": \"Linux\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.