CVE-2025-68366: 
Linux Kernel vulnerability analysis and mitigation

CVE-2025-68366 is a use-after-free vulnerability in the Linux kernel's NBD (Network Block Device) subsystem, specifically within the nbd_genl_connect function. It arises from a race condition between NBD_CMD_CONNECT and NBD_CLEAR_SOCK operations that can cause a reference count increment on a freed object. The vulnerability was published on December 24, 2025, and affects Linux kernel versions starting from 4.12 up to the patched releases (6.12.63, 6.17.13, 6.18.2, and 6.19-rc1). It carries a CVSS v3.1 base score of 5.5 (Medium) with HIGH availability impact (Microsoft MSRC, Feedly).

The root cause is a time-of-check/time-of-use (TOCTOU) race condition (CWE-416: Use After Free) in nbd_genl_connect. After nbd_start_device increments config_refs to 2 and the config_lock mutex is released, a concurrent NBD_CLEAR_SOCK operation followed by closing the NBD device can decrement config_refs to 0, freeing the config object. The subsequent refcount_inc(&nbd->config_refs) in nbd_genl_connect then operates on freed memory, triggering a refcount_t: addition on 0; use-after-free kernel warning. The fix defers the config unlock in nbd_genl_connect to prevent the race window. Exploitation requires local access with low privileges and the ability to issue concurrent NBD netlink operations (Feedly).

Successful exploitation can cause kernel memory corruption leading to a denial of service (system crash or hang) due to the use-after-free condition in the NBD subsystem. In more severe scenarios, memory corruption could theoretically be leveraged for arbitrary kernel code execution, though this is considered difficult in practice. The vulnerability's availability impact is rated HIGH, with no direct confidentiality or integrity impact identified. Affected systems include those running vulnerable Linux kernel versions (introduced in 4.12) with the NBD subsystem enabled, including Microsoft Azure Linux 3 kernel packages azl3_kernel_6.6.117.1-1 and azl3_kernel_6.6.119.3-3 (Microsoft MSRC, Feedly).

• Logs: Kernel log entries containing refcount_t: addition on 0; use-after-free or WARNING: CPU: ... at lib/refcount.c:25 refcount_warn_saturate associated with nbd_genl_connect.
• Logs: Kernel stack traces referencing nbd_genl_connect+0x16d0/0x1ab0, genl_family_rcv_msg_doit, or genl_rcv_msg in /var/log/kern.log or dmesg output.
• Process: Unexpected system instability, kernel panics, or crashes on systems actively using NBD devices.
• Network: Unusual or repeated NBD netlink (NETLINK_GENERIC) socket operations from low-privileged processes.

Apply the available kernel patches addressing this vulnerability. Fixed versions include Linux kernel 6.12.63, 6.17.13, 6.18.2, and 6.19-rc1, with specific commits available in the Linux kernel stable branches (Feedly). Distribution-specific updates have been released by Debian (linux 6.1.162-1), Ubuntu (USN-8179-1/2/3/4, USN-8184-1, USN-8185-1/2, USN-8203-1, USN-8258-1, USN-8260-1, USN-8265-1), Red Hat (RHSA-2026:21209, RHSA-2026:21556, RHSA-2026:23329, RHSA-2026:23224), Amazon Linux 2 (ALAS2KERNEL-5.10-2026-113, ALAS2KERNEL-5.15-2026-098), and SUSE. As a workaround where patching is not immediately possible, restrict access to NBD device operations to trusted users only (e.g., via user namespace restrictions or removing the nbd kernel module if not required).