Junglewise Threat Intelligence

CVE-2025-40080: Linux Kernel NBD socket type validation vulnerability

CVE-2025-40080 · Severity: info · CVSS 5.5 · Published 2025-10-28

Technologies: Linux Kernel, Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP. Vendors: Linux, Siemens.

Executive brief

A vulnerability in the Linux kernel's Network Block Device (NBD) driver could allow a local attacker to cause a system crash or instability. The NBD component, which allows a computer to use remote storage as if it were a local hard drive, failed to properly validate the types of network connections (sockets) it was using. By providing unexpected socket types, an attacker could trigger internal errors that disrupt system operations.

Technical details

A vulnerability was identified in the Linux kernel NBD (Network Block Device) driver where the `nbd_get_socket` function did not sufficiently validate the socket type provided during setup. While a previous fix ensured the socket supported a `shutdown()` method, it did not restrict the protocol family, allowing 'syzbot' and potentially local attackers to use unsupported socket types that could lead to kernel panics or undefined behavior. The fix explicitly restricts NBD to TCP and UNIX stream sockets by checking `sk_is_tcp` and `sk_is_stream_unix` within `drivers/block/nbd.c`. This issue affects various LTS kernel branches and has been patched in stable releases.

Affected products

  • Linux Linux Kernel 4.14.152, 4.19.82, 5.3.9, 5.4, and others prior to 6.11
  • Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP V3.1.6 and all versions less than *

Timeline

  • 2025-09-09: patched: Initial fix committed to mainline kernel
  • 2025-10-28: disclosed: CVE published to NVD

References

Related threats