Linux Kernel NBD Subsystem Denial-of-Service Vulnerability

A denial-of-service vulnerability has been identified in the Linux kernel's Network Block Device (NBD) subsystem. When using 'qemu-nbd' to disconnect a device, the process can become unresponsive for an extended period, blocking for over 368 seconds. This hang occurs because the 'NBD_DISCONNECT' command fails, leaving requests in flight that cannot be cleared due to a change in how the NBD module handles request timeouts. As a result, the requests remain incomplete, causing a prolonged I/O hang.

Impact

Exploitation of this vulnerability leads to a significant I/O hang, causing processes to become unresponsive for an extended period.

Reproduction

The vulnerability can be reproduced by using 'qemu-nbd' to disconnect a network block device. The 'NBD_DISCONNECT' command will fail, leaving requests in flight that cannot be cleared, causing the I/O hang.