{"id":"DEBIAN-CVE-2025-21731","details":"In the Linux kernel, the following vulnerability has been resolved:  nbd: don't allow reconnect after disconnect  Following process can cause nbd_config UAF:  1) grab nbd_config temporarily;  2) nbd_genl_disconnect() flush all recv_work() and release the initial reference:    nbd_genl_disconnect    nbd_disconnect_and_put     nbd_disconnect      flush_workqueue(nbd-\u003erecv_workq)     if (test_and_clear_bit(NBD_RT_HAS_CONFIG_REF, ...))      nbd_config_put      -\u003e due to step 1), reference is still not zero  3) nbd_genl_reconfigure() queue recv_work() again;    nbd_genl_reconfigure    config = nbd_get_config_unlocked(nbd)    if (!config)    -\u003e succeed    if (!test_bit(NBD_RT_BOUND, ...))    -\u003e succeed    nbd_reconnect_socket     queue_work(nbd-\u003erecv_workq, &args-\u003ework)  4) step 1) release the reference;  5) Finially, recv_work() will trigger UAF:    recv_work    nbd_config_put(nbd)    -\u003e nbd_config is freed    atomic_dec(&config-\u003erecv_threads)    -\u003e UAF  Fix the problem by clearing NBD_RT_BOUND in nbd_genl_disconnect(), so that nbd_genl_reconfigure() will fail.","modified":"2026-09-01T16:06:09.770091516Z","published":"2025-02-27T02:15:16.833Z","upstream":["CVE-2025-21731"],"references":[{"type":"ADVISORY","url":"https://security-tracker.debian.org/tracker/CVE-2025-21731"}],"affected":[{"package":{"name":"linux","ecosystem":"Debian:12","purl":"pkg:deb/debian/linux?arch=source&distro=bookworm"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.1.129-1"}]}],"versions":["6.1.106-1","6.1.106-2","6.1.106-3","6.1.112-1","6.1.115-1","6.1.119-1","6.1.123-1","6.1.124-1","6.1.128-1","6.1.27-1","6.1.37-1","6.1.38-1","6.1.38-2","6.1.38-2~bpo11+1","6.1.38-3","6.1.38-4","6.1.38-4~bpo11+1","6.1.52-1","6.1.55-1","6.1.55-1~bpo11+1","6.1.64-1","6.1.66-1","6.1.67-1","6.1.69-1","6.1.69-1~bpo11+1","6.1.76-1","6.1.76-1~bpo11+1","6.1.82-1","6.1.85-1","6.1.90-1","6.1.90-1~bpo11+1","6.1.94-1","6.1.94-1~bpo11+1","6.1.98-1","6.1.99-1"],"ecosystem_specific":{"urgency":"not yet assigned"},"database_specific":{"source":"https://storage.googleapis.com/osv-test-debian-osv/debian-cve-osv/DEBIAN-CVE-2025-21731.json"}},{"package":{"name":"linux","ecosystem":"Debian:13","purl":"pkg:deb/debian/linux?arch=source&distro=trixie"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.13-1"}]}],"ecosystem_specific":{"urgency":"not yet assigned"},"database_specific":{"source":"https://storage.googleapis.com/osv-test-debian-osv/debian-cve-osv/DEBIAN-CVE-2025-21731.json"}},{"package":{"name":"linux","ecosystem":"Debian:14","purl":"pkg:deb/debian/linux?arch=source&distro=forky"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.13-1"}]}],"ecosystem_specific":{"urgency":"not yet assigned"},"database_specific":{"source":"https://storage.googleapis.com/osv-test-debian-osv/debian-cve-osv/DEBIAN-CVE-2025-21731.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"}]}