{
  "affected": [
    {
      "ecosystem_specific": {
        "urgency": "not yet assigned"
      },
      "package": {
        "ecosystem": "Debian:12",
        "name": "linux"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.1.162-1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "ecosystem_specific": {
        "urgency": "not yet assigned"
      },
      "package": {
        "ecosystem": "Debian:13",
        "name": "linux"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.12.63-1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "ecosystem_specific": {
        "urgency": "not yet assigned"
      },
      "package": {
        "ecosystem": "Debian:14",
        "name": "linux"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.17.13-1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "details": "In the Linux kernel, the following vulnerability has been resolved:  nbd: defer config put in recv_work  There is one uaf issue in recv_work when running NBD_CLEAR_SOCK and NBD_CMD_RECONFIGURE:   nbd_genl_connect     // conf_ref=2 (connect and recv_work A)   nbd_open\t       // conf_ref=3   recv_work A done     // conf_ref=2   NBD_CLEAR_SOCK       // conf_ref=1   nbd_genl_reconfigure // conf_ref=2 (trigger recv_work B)   close nbd\t       // conf_ref=1   recv_work B     config_put         // conf_ref=0     atomic_dec(\u0026config-\u003erecv_threads); -\u003e UAF  Or only running NBD_CLEAR_SOCK:   nbd_genl_connect   // conf_ref=2   nbd_open \t     // conf_ref=3   NBD_CLEAR_SOCK     // conf_ref=2   close nbd     nbd_release       config_put     // conf_ref=1   recv_work     config_put \t     // conf_ref=0     atomic_dec(\u0026config-\u003erecv_threads); -\u003e UAF  Commit 87aac3a80af5 (\"nbd: call nbd_config_put() before notifying the waiter\") moved nbd_config_put() to run before waking up the waiter in recv_work, in order to ensure that nbd_start_device_ioctl() would not be woken up while nbd-\u003etask_recv was still uncleared.  However, in nbd_start_device_ioctl(), after being woken up it explicitly calls flush_workqueue() to make sure all current works are finished. Therefore, there is no need to move the config put ahead of the wakeup.  Move nbd_config_put() to the end of recv_work, so that the reference is held for the whole lifetime of the worker thread. This makes sure the config cannot be freed while recv_work is still running, even if clear + reconfigure interleave.  In addition, we don't need to worry about recv_work dropping the last nbd_put (which causes deadlock):  path A (netlink with NBD_CFLAG_DESTROY_ON_DISCONNECT):   connect  // nbd_refs=1 (trigger recv_work)   open nbd // nbd_refs=2   NBD_CLEAR_SOCK   close nbd     nbd_release       nbd_disconnect_and_put         flush_workqueue // recv_work done       nbd_config_put         nbd_put // nbd_refs=1       nbd_put // nbd_refs=0         queue_work  path B (netlink without NBD_CFLAG_DESTROY_ON_DISCONNECT):   connect  // nbd_refs=2 (trigger recv_work)   open nbd // nbd_refs=3   NBD_CLEAR_SOCK // conf_refs=2   close nbd     nbd_release       nbd_config_put // conf_refs=1       nbd_put // nbd_refs=2   recv_work done // conf_refs=0, nbd_refs=1   rmmod // nbd_refs=0  Depends-on: e2daec488c57 (\"nbd: Fix hungtask when nbd_config_put\")",
  "id": "DEBIAN-CVE-2025-68372",
  "modified": "2026-09-01T19:48:30.496254190Z",
  "published": "2025-12-24T11:16:00.777Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://security-tracker.debian.org/tracker/CVE-2025-68372"
    }
  ],
  "upstream": [
    "CVE-2025-68372"
  ]
}