CVE-2025-21731

Summary

CVE-2025-21731 is a vulnerability affecting the Linux kernel's nbd (Network Block Device) subsystem. The issue arises due to a use-after-free condition when nbd_genl_reconfigure() requeues recv_work() before the reference to nbd_config is released in nbd_genl_disconnect(). This sequence of events can lead to a User-after-Free (UAF) vulnerability. A malicious user could exploit this flaw to execute arbitrary code or cause a denial-of-service condition. The vulnerability is remediated by clearing NBD_RT_BOUND in nbd_genl_disconnect() to prevent nbd_genl_reconfigure() from requeuing recv_work() before the reference to nbd_config is properly released.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.