CVEvulnerability
CVE-2025-40080
- Status
- Deferred
- Published
- 2025-10-28
- Last modified
- 2026-10-19
- Assigner
- 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Description
In the Linux kernel, the following vulnerability has been resolved:
nbd: restrict sockets to TCP and UDP
Recently, syzbot started to abuse NBD with all kinds of sockets.
Commit cf1b2326b734 ("nbd: verify socket is supported during setup")
made sure the socket supported a shutdown() method.
Explicitely accept TCP and UNIX stream sockets.
References
- https://git.kernel.org/stable/c/37ad11f20e164c23ce827dd455b42c0fdd29685c git.kernel.org
- https://git.kernel.org/stable/c/4f9e6ff6319dbcebea64b50af0304cf0ad7e97e7 git.kernel.org
- https://git.kernel.org/stable/c/808e2335bc1cf2293b9e36ccc94c267c81509c71 git.kernel.org
- https://git.kernel.org/stable/c/9f7c02e031570e8291a63162c6c046dc15ff85b0 git.kernel.org
- https://git.kernel.org/stable/c/c365e8f20f4201d873a70385bd919f0fb531e960 git.kernel.org
- https://cert-portal.siemens.com/productcert/html/ssa-019113.html cert-portal.siemens.com
- https://cert-portal.siemens.com/productcert/html/ssa-457936.html cert-portal.siemens.com