{"affected":[{"defaultStatus":"unaffected","product":"Linux","source":"CNA: Linux","vendor":"Linux","versions":[{"lessThan":"cb121c47f364b51776c4db904a6a5a90ab0a7ec5","status":"affected","version":"6497ef8df568afbf5f3e38825a4590ff41611a54","versionType":"git"},{"lessThan":"91fa560c73a8126868848ed6cd70607cbf8d87e2","status":"affected","version":"6497ef8df568afbf5f3e38825a4590ff41611a54","versionType":"git"},{"lessThan":"d46186eb7bbd9a11c145120f2d77effa8d4d44c2","status":"affected","version":"6497ef8df568afbf5f3e38825a4590ff41611a54","versionType":"git"},{"lessThan":"8586552df591e0a367eff44af0c586213eeecc3f","status":"affected","version":"6497ef8df568afbf5f3e38825a4590ff41611a54","versionType":"git"},{"lessThan":"002aca89753f666d878ca0eb8584c372684ac4ba","status":"affected","version":"6497ef8df568afbf5f3e38825a4590ff41611a54","versionType":"git"},{"lessThan":"aa9552438ebf015fc5f9f890dbfe39f0c53cf37e","status":"affected","version":"6497ef8df568afbf5f3e38825a4590ff41611a54","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","source":"CNA: Linux","vendor":"Linux","versions":[{"status":"affected","version":"5.14"},{"lessThan":"5.14","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.189","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.146","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.99","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.39","versionType":"semver"},{"lessThanOrEqual":"6.15.*","status":"unaffected","version":"6.15.7","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"6.16","versionType":"original_commit_for_fix"}]}],"cveId":"CVE-2025-38443","cwes":[],"description":"In the Linux kernel, the following vulnerability has been resolved:\n\nnbd: fix uaf in nbd_genl_connect() error path\n\nThere is a use-after-free issue in nbd:\n\nblock nbd6: Receive control failed (result -104)\nblock nbd6: shutting down sockets\n==================================================================\nBUG: KASAN: slab-use-after-free in recv_work+0x694/0xa80 drivers/block/nbd.c:1022\nWrite of size 4 at addr ffff8880295de478 by task kworker/u33:0/67\n\nCPU: 2 UID: 0 PID: 67 Comm: kworker/u33:0 Not tainted 6.15.0-rc5-syzkaller-00123-g2c89c1b655c0 #0 PREEMPT(full)\nHardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014\nWorkqueue: nbd6-recv recv_work\nCall Trace:\n <TASK>\n __dump_stack lib/dump_stack.c:94 [inline]\n dump_stack_lvl+0x116/0x1f0 lib/dump_stack.c:120\n print_address_description mm/kasan/report.c:408 [inline]\n print_report+0xc3/0x670 mm/kasan/report.c:521\n kasan_report+0xe0/0x110 mm/kasan/report.c:634\n check_region_inline mm/kasan/generic.c:183 [inline]\n kasan_check_range+0xef/0x1a0 mm/kasan/generic.c:189\n instrument_atomic_read_write include/linux/instrumented.h:96 [inline]\n atomic_dec include/linux/atomic/atomic-instrumented.h:592 [inline]\n recv_work+0x694/0xa80 drivers/block/nbd.c:1022\n process_one_work+0x9cc/0x1b70 kernel/workqueue.c:3238\n process_scheduled_works kernel/workqueue.c:3319 [inline]\n worker_thread+0x6c8/0xf10 kernel/workqueue.c:3400\n kthread+0x3c2/0x780 kernel/kthread.c:464\n ret_from_fork+0x45/0x80 arch/x86/kernel/process.c:153\n ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245\n </TASK>\n\nnbd_genl_connect() does not properly stop the device on certain\nerror paths after nbd_start_device() has been called. This causes\nthe error path to put nbd->config while recv_work continue to use\nthe config after putting it, leading to use-after-free in recv_work.\n\nThis patch moves nbd_start_device() after the backend file creation.","epss":{"date":"2026-11-05","percentile":0.07995,"score":0.00183},"exploits":[],"kev":null,"metrics":[],"modifiedAt":1793912558456,"publishedAt":1753457246671,"references":[{"source":"CNA: Linux","tags":[],"url":"https://git.kernel.org/stable/c/cb121c47f364b51776c4db904a6a5a90ab0a7ec5"},{"source":"CNA: Linux","tags":[],"url":"https://git.kernel.org/stable/c/91fa560c73a8126868848ed6cd70607cbf8d87e2"},{"source":"CNA: Linux","tags":[],"url":"https://git.kernel.org/stable/c/d46186eb7bbd9a11c145120f2d77effa8d4d44c2"},{"source":"CNA: Linux","tags":[],"url":"https://git.kernel.org/stable/c/8586552df591e0a367eff44af0c586213eeecc3f"},{"source":"CNA: Linux","tags":[],"url":"https://git.kernel.org/stable/c/002aca89753f666d878ca0eb8584c372684ac4ba"},{"source":"CNA: Linux","tags":[],"url":"https://git.kernel.org/stable/c/aa9552438ebf015fc5f9f890dbfe39f0c53cf37e"},{"source":"ADP: CVE","tags":[],"url":"https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html"}],"remediation":[],"revision":"5a0a39403caba0cdee8a25e65da5d51b71ec7a5a08f22d1ee20d13477dfb77b2","sources":[{"modifiedAt":1793912558456,"name":"CNA: Linux","retrievedAt":1793913700314,"url":"https://www.cve.org/CVERecord?id=CVE-2025-38443"},{"modifiedAt":null,"name":"FIRST EPSS","retrievedAt":1793913703360,"url":"https://api.first.org/data/v1/epss?cve=CVE-2025-38443"}],"ssvc":{"assessedAt":1793912210472,"automatable":"no","exploitation":"none","source":"ADP: CISA-ADP","technicalImpact":"partial"},"status":"published","title":"nbd: fix uaf in nbd_genl_connect() error path","updatedAt":1793913703360}