Use-After-Free Vulnerability in Linux Kernel NBD Driver

CVE-2025-38443

What is CVE-2025-38443?

A use-after-free vulnerability exists in the NBD (Network Block Device) driver of the Linux kernel, which occurs when the error path of nbd_genl_connect() fails to halt the device appropriately after calling nbd_start_device(). This mismanagement can lead to the configuration being freed while still in use by the recv_work function, causing instability and potential exploitation in systems using the NBD driver.

References