CVE-2025-68372: 
Linux Kernel vulnerability analysis and mitigation

CVE-2025-68372 is a use-after-free (UAF) vulnerability in the Linux kernel's NBD (Network Block Device) subsystem, specifically within the recv_work function. It arises from improper reference counting of the NBD configuration object when NBD_CLEAR_SOCK and/or NBD_CMD_RECONFIGURE operations are performed, allowing the config structure to be freed while recv_work is still executing. The vulnerability was published on December 24, 2025, and affects the Linux kernel broadly, with confirmed impact on Microsoft Azure Linux 3 kernel versions 6.6.117.1-1 and 6.6.119.3-3. It carries a CVSS v3.1 base score of 5.5 (Medium) (Feedly, Microsoft MSRC).

The root cause is a use-after-free condition (CWE-416) in the Linux kernel NBD subsystem. A prior commit (87aac3a80af5) moved nbd_config_put() to execute before waking the waiter in recv_work to prevent nbd_start_device_ioctl() from being woken while nbd->task_recv was still set; however, nbd_start_device_ioctl() already calls flush_workqueue() after waking to ensure all work is complete, making the early config_put unnecessary and dangerous. When a local attacker with low privileges sequences NBD_CLEAR_SOCK and NBD_CMD_RECONFIGURE (or simply NBD_CLEAR_SOCK combined with closing the NBD device), the configuration reference counter can reach zero and the config memory freed before recv_work finishes, causing atomic_dec(&config->recv_threads) to access freed memory. The fix moves nbd_config_put() to the end of recv_work, ensuring the reference is held for the full lifetime of the worker thread (Feedly, kernel.org patch).

Successful exploitation by a local attacker with low privileges can cause a kernel crash (panic) via access to freed memory, resulting in a denial of service. While the primary impact is availability degradation, use-after-free vulnerabilities in kernel subsystems can in some cases be leveraged for privilege escalation or arbitrary kernel code execution, though no such exploitation has been demonstrated for this specific CVE. Confidentiality and integrity are not directly impacted under the assessed CVSS scoring (Feedly, Microsoft MSRC).

• Logs: Kernel oops or panic messages in /var/log/kern.log or dmesg output referencing use-after-free in the NBD subsystem (nbd, recv_work, nbd_config_put, or atomic_dec).
• Logs: Kernel crash dumps (kdump/vmcore) triggered unexpectedly on systems using NBD devices.
• Process/Behavior: Unexpected system reboots or kernel panics on hosts actively using NBD (Network Block Device) with concurrent socket clear and reconfigure operations.
• File System: Presence of core dump files or crash reports in /var/crash/ or /var/lib/systemd/coredump/ following NBD operations.

Apply the available kernel patch that moves nbd_config_put() to the end of recv_work, which is included in updated Linux kernel stable releases. For Microsoft Azure Linux 3, update from the vulnerable kernel versions (6.6.117.1-1 and 6.6.119.3-3) to the patched versions. Downstream distributions including Debian (linux 6.1.162-1), Ubuntu (USN-8179-1 through USN-8265-1), SUSE, Oracle Linux, and Amazon Linux 2 have also released kernel updates addressing this CVE. As a workaround, restrict NBD device access and operations to trusted users only, since exploitation requires local access with low privileges (Feedly, Microsoft MSRC, Debian Tracker, Ubuntu USN-8179-1).