Critical Vulnerability in Linux Package: NBD Socket Restriction Flaw
Summary
DEBIAN-CVE-2025-40080: In the Linux kernel, the following vulnerability has been resolved: nbd: restrict sockets to TCP and UDP Recently, syzbot started to abuse NBD with all kinds of sockets. Affects linux versions 5.10.103-1 – 6.9.9-1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux package is a core component of the Debian operating system, providing essential functionalities for managing system resources and hardware interactions. It is widely used across various distributions and is known for its stability and performance. However, recent vulnerabilities have raised concerns regarding its security, particularly with the Network Block Device (NBD) feature, which allows block devices to be accessed over a network.
Vulnerability Detail
In the Linux kernel, a vulnerability has been identified related to the Network Block Device (NBD) where syzbot has been exploiting NBD with various socket types. The issue arises from the lack of restrictions on socket types used during NBD setup, potentially allowing unsupported socket types to be utilized. This vulnerability was addressed in commit cf1b2326b734, which ensures that only sockets with a shutdown() method are accepted, specifically restricting to TCP and UNIX stream sockets. Failure to address this could lead to unauthorized access or denial of service.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, users can restrict the use of NBD to only TCP and UNIX stream sockets until the package is updated. This can be done by modifying the NBD configuration to explicitly specify the allowed socket types.
Conclusion
The vulnerability in the Linux package concerning NBD socket restrictions poses significant security risks. Users are urged to update their systems to the latest patched versions to mitigate these risks. Utilizing tools like Vulert can help monitor and alert for such vulnerabilities in real-time.
See every vulnerability recorded for linux →
FAQ
NBD stands for Network Block Device, which allows block devices to be accessed over a network, enabling remote storage solutions.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The risks include unauthorized access to system resources and potential denial of service, which could disrupt normal operations.
Yes, the vulnerability has been addressed in the latest patched versions of the Linux package across Debian versions 11, 12, 13, and 14.
It is recommended to regularly check for updates and apply them promptly to ensure your system is protected against known vulnerabilities.
References
Related vulnerabilities
Recent vulnerabilities recorded for linux.
