High 7.8Published Feb 26, 2025

CVE-2025-21731nbd: don't allow reconnect after disconnect

Updated under an hour ago (Oct 27, 2026, 10:23 AM ET)

Does this affect you?

It affects Linux and 5 other products. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Linux

Exploited in the last 30 days

In the Linux kernel, the following vulnerability has been resolved: nbd: don't allow reconnect after disconnect Following process can cause nbd_config UAF: 1) grab nbd_config temporarily; 2) nbd_genl_disconnect() flush all recv_work() and release the initial reference: nbd_genl_disconnect nbd_disconnect_and_put nbd_disconnect flush_workqueue(nbd->recv_workq) if (test_and_clear_bit(NBD_RT_HAS_CONFIG_REF, ...)) nbd_config_put -> due to step 1), reference is still not zero 3) nbd_genl_reconfigure() queue recv_work() again; nbd_genl_reconfigure config = nbd_get_config_unlocked(nbd) if (!config) -> succeed if (!test_bit(NBD_RT_BOUND, ...)) -> succeed nbd_reconnect_socket queue_work(nbd->recv_workq, &args->work) 4) step 1) release the reference; 5) Finially, recv_work() will trigger UAF: recv_work nbd_config_put(nbd) -> nbd_config is freed atomic_dec(&config->recv_threads) -> UAF Fix the problem by clearing NBD_RT_BOUND in nbd_genl_disconnect(), so that nbd_genl_reconfigure() will fail.

CVSS: 7.8 HIGH (v3.1, CISA ADP)CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weakness (CWE): CWE-416
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: Linux
NVD analysis: Modified
Record last updated: Oct 14, 2026
First seen by InfoSec Signals: Oct 14, 2026

Affected products

Affected products

Linux Linux linux:linux (from the name)	from b7aa3d39385dc2d95899f9e379623fef446a2acd before e70a578487a47d7cf058904141e586684d1c3381; from b7aa3d39385dc2d95899f9e379623fef446a2acd before 6bef6222a3f6c7adb6396f77f25a3579d821b09a; from b7aa3d39385dc2d95899f9e379623fef446a2acd before e3be8862d73cac833e0fb7602636c19c6cb94b11; from b7aa3d39385dc2d95899f9e379623fef446a2acd before e7343fa33751cb07c1c56b666bf37cfca357130e; from b7aa3d39385dc2d95899f9e379623fef446a2acd before d208d2c52b652913b5eefc8ca434b0d6b757f68f; from b7aa3d39385dc2d95899f9e379623fef446a2acd before a8ee6ecde2b7bfb58c8a3afe8a9d2b848f580739; from b7aa3d39385dc2d95899f9e379623fef446a2acd before 9793bd5ae4bdbdb2dde401a3cab94a6bfd05e302; from b7aa3d39385dc2d95899f9e379623fef446a2acd before 844b8cdc681612ff24df62cdefddeab5772fadf1	CNA record
Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP siemens:simatic_s7_1500_cpu_1518_4_pn_dp_mfp (from the name)	from V3.1.6	CISA ADP
Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP siemens:simatic_s7_1500_cpu_1518f_4_pn_dp_mfp (from the name)	from V3.1.6	CISA ADP
Siemens SIMATIC S7-1500 TM MFP - GNU/Linux subsystem siemens:simatic_s7_1500_tm_mfp_gnu_linux_subsystem (from the name)	all versions	CISA ADP
Siemens SIPLUS S7-1500 CPU 1518-4 PN/DP MFP siemens:siplus_s7_1500_cpu_1518_4_pn_dp_mfp (from the name)	from V3.1.6	CISA ADP
linux linux_kernel linux:linux_kernel	from 4.12 before 5.4.291; from 5.5 before 5.10.235; from 5.11 before 5.15.179; from 5.16 before 6.1.129; from 6.2 before 6.6.76; from 6.7 before 6.12.13; from 6.13 before 6.13.2	NVD

References

References

https://git.kernel.org/stable/c/e70a578487a47d7cf058904141e586684d1c3381	patch
https://git.kernel.org/stable/c/6bef6222a3f6c7adb6396f77f25a3579d821b09a	patch
https://git.kernel.org/stable/c/e3be8862d73cac833e0fb7602636c19c6cb94b11	patch
https://git.kernel.org/stable/c/e7343fa33751cb07c1c56b666bf37cfca357130e	patch
https://git.kernel.org/stable/c/d208d2c52b652913b5eefc8ca434b0d6b757f68f	patch
https://git.kernel.org/stable/c/a8ee6ecde2b7bfb58c8a3afe8a9d2b848f580739	patch
https://git.kernel.org/stable/c/9793bd5ae4bdbdb2dde401a3cab94a6bfd05e302	patch
https://git.kernel.org/stable/c/844b8cdc681612ff24df62cdefddeab5772fadf1	patch
https://lists.debian.org/debian-lts-announce/2025/03/msg00028.html
https://lists.debian.org/debian-lts-announce/2025/05/msg00030.html
1–10 of 13

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.