kernel: nbd: fix incomplete validation of ioctl arg

A flaw has been found in the Linux kernel’s NBD drivers.The issue stems from incomplete validation of IOCTL arguments passed to the NBD driver. Specifically, oversized or unchecked arguments may lead to a signed integer overflow in blockwritefullpage and misuse of argument values cast to int in...

USN-7879-2 linux-realtime-6.14 vulnerabilities

It was discovered that improper initialization of CPU cache memory could allow a local attacker with hypervisor access to overwrite SEV-SNP guest memory resulting in loss of data integrity. CVE-2024-36331 Several security issues were discovered in the Linux kernel. An attacker could possibly use...

TencentOS Server 4: libnbd (TSSA-2024:0621)

The version of Tencent Linux installed on the remote TencentOS Server 4 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the TSSA-2024:0621 advisory. Package updates are available for TencentOS Server 4 that fix the following vulnerabilities:...

CVE-2025-40147

In the Linux kernel, the following vulnerability has been resolved: blk-throttle: fix access race during throttle policy activation On repeated cold boots we occasionally hit a NULL pointer crash in blkshouldthrotl when throttling is consulted before the throttle policy is fully enabled for the...

PT-2025-52902

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description The Linux kernel contains a use-after-free issue within the nbd genl connect function. This occurs when handling NBD CMD CONNECT and NBD CLEAR SOCK operations, specifically related to th...

[SECURITY] Fedora 41 Update: libnbd-1.22.5-1.fc41

NBD =E2=80=94 Network Block Device =E2=80=94 is a protocol for accessing Bloc k Devices hard disks and disk-like things over a Network. This is the NBD client library in userspace, a simple library for writing NBD clients. The key features are: Synchronous and asynchronous APIs, both for ease of...

[SECURITY] Fedora 42 Update: libnbd-1.22.5-1.fc42

NBD =E2=80=94 Network Block Device =E2=80=94 is a protocol for accessing Bloc k Devices hard disks and disk-like things over a Network. This is the NBD client library in userspace, a simple library for writing NBD clients. The key features are: Synchronous and asynchronous APIs, both for ease of...

PT-2025-52908

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description The Linux kernel contains a use-after-free UAF issue within the Network Block Device NBD subsystem. The issue occurs in the recv work function when handling NBD CLEAR SOCK and NBD CMD...

Unity Linux 20.1070a Security Update: kernel (UTSA-2025-990447)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-990447 advisory. In the Linux kernel, the following vulnerability has been resolved: nbd: fix race between nbdallocconfig and module removal When nbd module is being removing,...

Unity Linux 20.1070a Security Update: kernel (UTSA-2025-990636)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-990636 advisory. In the Linux kernel, the following vulnerability has been resolved: nbd: fix io hung while disconnecting device In our tests, qemu-nbd triggers a io hung: INFO: task...

[SECURITY] Fedora 43 Update: libnbd-1.23.10-1.fc43

NBD =E2=80=94 Network Block Device =E2=80=94 is a protocol for accessing Bloc k Devices hard disks and disk-like things over a Network. This is the NBD client library in userspace, a simple library for writing NBD clients. The key features are: Synchronous and asynchronous APIs, both for ease of...

Unity Linux 20.1050e Security Update: kernel (UTSA-2025-990005)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-990005 advisory. In the Linux kernel, the following vulnerability has been resolved: nbd: fix race between nbdallocconfig and module removal When nbd module is being removing,...

Unity Linux 20.1050e Security Update: kernel (UTSA-2025-990169)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-990169 advisory. In the Linux kernel, the following vulnerability has been resolved: nbd: fix io hung while disconnecting device In our tests, qemu-nbd triggers a io hung: INFO: task...

Unity Linux 20.1070e Security Update: kernel (UTSA-2025-989701)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-989701 advisory. In the Linux kernel, the following vulnerability has been resolved: nbd: fix io hung while disconnecting device In our tests, qemu-nbd triggers a io hung: INFO: task...

Unity Linux 20.1070a Security Update: kernel (UTSA-2025-988996)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-988996 advisory. In the Linux kernel, the following vulnerability has been resolved: nbd: fix race between nbdallocconfig and module removal When nbd module is being removing,...

Astra Linux – Vulnerability in Linux 6.12

In the Linux kernel, the following vulnerability has been resolved: lib/groupcpus: Fixed the issue of NULL pointer dereferencing in groupcpusevenly. While testing nullblk with configfs, the command echo 0 pollqueues would trigger the following panic: BUG: NULL pointer dereferencing in the kernel,...

Astra Linux – Vulnerability in libnbd

A flaw was discovered in libnbd. A server may respond with a block size larger than 2^63 the NBD specification states that the size is a 64-bit unsigned value. This issue could cause an application to crash or lead to other unintended behaviors for NBD clients that do not properly handle the retu...

SUSE CVE-2025-40080

In the Linux kernel, the following vulnerability has been resolved: nbd: restrict sockets to TCP and UDP Recently, syzbot started to abuse NBD with all kinds of sockets. Commit cf1b2326b734 "nbd: verify socket is supported during setup" made sure the socket supported a shutdown method. Explicitel...

CVE-2025-40080

In the Linux kernel, the following vulnerability has been resolved: nbd: restrict sockets to TCP and UDP Recently, syzbot started to abuse NBD with all kinds of sockets. Commit cf1b2326b734 "nbd: verify socket is supported during setup" made sure the socket supported a shutdown method. Explicitel...

CVE-2025-40080

In the Linux kernel, the following vulnerability has been resolved: nbd: restrict sockets to TCP and UDP Recently, syzbot started to abuse NBD with all kinds of sockets. Commit cf1b2326b734 "nbd: verify socket is supported during setup" made sure the socket supported a shutdown method. Explicitel...