GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2025-40171 (GCVE-0-2025-40171)

Vulnerability from cvelistv5 – Published: 2025-11-12 10:46 – Updated: 2026-08-05 12:08
VLAI
Title
nvmet-fc: move lsop put work to nvmet_fc_ls_req_op
Summary
In the Linux kernel, the following vulnerability has been resolved: nvmet-fc: move lsop put work to nvmet_fc_ls_req_op It’s possible for more than one async command to be in flight from __nvmet_fc_send_ls_req. For each command, a tgtport reference is taken. In the current code, only one put work item is queued at a time, which results in a leaked reference. To fix this, move the work item to the nvmet_fc_ls_req_op struct, which already tracks all resources related to the command.
Severity
7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 5e0bc09a52b6169ce90f7ac6e195791adb16cec4 , < 11269c08013f4ee8b8f5edc6c56700acb34092d0 (git)
Affected: 9e6987f8937a7bd7516aa52f25cb7e12c0c92ee8 , < a28112cc55013cd8cbd5d36b5115a5b851151bd9 (git)
Affected: eaf0971fdabf2a93c1429dc6bedf3bbe85dffa30 , < 060ecc81240ef9d60d9485a3a5eb55a0d6e7a25c (git)
Affected: 710c69dbaccdac312e32931abcb8499c1525d397 , < 7331925c247b03b7767b8cd93cfe1b7aa2377850 (git)
Affected: 710c69dbaccdac312e32931abcb8499c1525d397 , < 7a619f8c869117ffed08365b377f66b7e1d941b4 (git)
Affected: 710c69dbaccdac312e32931abcb8499c1525d397 , < db5a5406fb7e5337a074385c7a3e53c77f2c1bd3 (git)
Affected: 1d86f79287206deec36d63b89c741cf542b6cadd (git)
Affected: 5.15.150 , < 5.15.195 (semver)
Affected: 6.1.80 , < 6.1.156 (semver)
Affected: 6.6.19 , < 6.6.112 (semver)
Affected: 6.7.7 , < 6.8 (semver)
guessed Create a notification for this product.
Linux Linux Affected: 6.8
Unaffected: 0 , < 6.8 (semver)
Unaffected: 5.15.195 , ≤ 5.15.* (semver)
Unaffected: 6.1.156 , ≤ 6.1.* (semver)
Unaffected: 6.6.112 , ≤ 6.6.* (semver)
Unaffected: 6.12.53 , ≤ 6.12.* (semver)
Unaffected: 6.17.3 , ≤ 6.17.* (semver)
Unaffected: 6.18 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/nvme/target/fc.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "11269c08013f4ee8b8f5edc6c56700acb34092d0",
              "status": "affected",
              "version": "5e0bc09a52b6169ce90f7ac6e195791adb16cec4",
              "versionType": "git"
            },
            {
              "lessThan": "a28112cc55013cd8cbd5d36b5115a5b851151bd9",
              "status": "affected",
              "version": "9e6987f8937a7bd7516aa52f25cb7e12c0c92ee8",
              "versionType": "git"
            },
            {
              "lessThan": "060ecc81240ef9d60d9485a3a5eb55a0d6e7a25c",
              "status": "affected",
              "version": "eaf0971fdabf2a93c1429dc6bedf3bbe85dffa30",
              "versionType": "git"
            },
            {
              "lessThan": "7331925c247b03b7767b8cd93cfe1b7aa2377850",
              "status": "affected",
              "version": "710c69dbaccdac312e32931abcb8499c1525d397",
              "versionType": "git"
            },
            {
              "lessThan": "7a619f8c869117ffed08365b377f66b7e1d941b4",
              "status": "affected",
              "version": "710c69dbaccdac312e32931abcb8499c1525d397",
              "versionType": "git"
            },
            {
              "lessThan": "db5a5406fb7e5337a074385c7a3e53c77f2c1bd3",
              "status": "affected",
              "version": "710c69dbaccdac312e32931abcb8499c1525d397",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "1d86f79287206deec36d63b89c741cf542b6cadd",
              "versionType": "git"
            },
            {
              "lessThan": "5.15.195",
              "status": "affected",
              "version": "5.15.150",
              "versionType": "semver"
            },
            {
              "lessThan": "6.1.156",
              "status": "affected",
              "version": "6.1.80",
              "versionType": "semver"
            },
            {
              "lessThan": "6.6.112",
              "status": "affected",
              "version": "6.6.19",
              "versionType": "semver"
            },
            {
              "lessThan": "6.8",
              "status": "affected",
              "version": "6.7.7",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/nvme/target/fc.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.8"
            },
            {
              "lessThan": "6.8",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.195",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.156",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.112",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.53",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.17.*",
              "status": "unaffected",
              "version": "6.17.3",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.18",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.195",
                  "versionStartIncluding": "5.15.150",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.156",
                  "versionStartIncluding": "6.1.80",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.112",
                  "versionStartIncluding": "6.6.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.53",
                  "versionStartIncluding": "6.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.17.3",
                  "versionStartIncluding": "6.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18",
                  "versionStartIncluding": "6.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "6.7.7",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnvmet-fc: move lsop put work to nvmet_fc_ls_req_op\n\nIt\u2019s possible for more than one async command to be in flight from\n__nvmet_fc_send_ls_req. For each command, a tgtport reference is taken.\n\nIn the current code, only one put work item is queued at a time, which\nresults in a leaked reference.\n\nTo fix this, move the work item to the nvmet_fc_ls_req_op struct, which\nalready tracks all resources related to the command."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - The trigger is a remote FC-NVMe initiator sending Create Association / Disconnect Association Link Services to the nvmet-fc target port, processed via `nvmet_fc_rcv_ls_req()` from the LLDD (lpfc). Consistent with other NVMe-oF target CVEs in this tree (including qla2xxx FC), the attacker is a remote peer on the storage fabric, which can itself be extended over routed transports.\nAC:L - The attacker controls both sides of the timing \u2014 issuing several associations and then disconnecting them concurrently reliably puts multiple LS requests in flight, and `queue_work()` deterministically drops every put after the first while one is pending. No memory-layout or victim-state condition is involved.\nPR:N - `nvmet_fc_ls_create_association()` and `nvmet_fc_ls_disconnect()` validate only LS descriptor lengths and tags; there is no host-NQN allow-list check, NVMe Connect, or authentication on this path. Any initiator that can reach the target port exercises it pre-authentication.\nUI:N - The leak is produced entirely by attacker-sent Link Service frames handled asynchronously by the target. No administrator or local user action is required.\nS:U - The leaked reference, stranded allocation, and failed teardown are all confined to the kernel of the target host. No security authority boundary such as a VM or IOMMU domain is crossed.\nC:N - The defect is purely a missed `kref_put()`; nothing is freed early, read out of bounds, or returned to the attacker. Tracing the coalescing shows it can only drop puts, never duplicate them, so no use-after-free read primitive exists.\nI:N - No memory is corrupted or written out of bounds \u2014 the refcount only ever ends too high, so no write or control-flow-hijack primitive arises. lpfc additionally guards its on-stack completion in `lpfc_nvmet_targetport_delete()`, closing the only late-completion write hazard.\nA:H - The tgtport is never freed, so `nvmet_fc_free_ls_iodlist()` and `targetport_delete` never run: `lpfc_nvmet_destroy_targetport()` stalls for `LPFC_NVMET_WAIT_TMO` (5 s) and then aborts with an error, permanently stranding the target port, its HBA DMA mappings, and a `get_device()` reference that no longer can be released without a reboot."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:08:16.789Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/11269c08013f4ee8b8f5edc6c56700acb34092d0"
        },
        {
          "url": "https://git.kernel.org/stable/c/a28112cc55013cd8cbd5d36b5115a5b851151bd9"
        },
        {
          "url": "https://git.kernel.org/stable/c/060ecc81240ef9d60d9485a3a5eb55a0d6e7a25c"
        },
        {
          "url": "https://git.kernel.org/stable/c/7331925c247b03b7767b8cd93cfe1b7aa2377850"
        },
        {
          "url": "https://git.kernel.org/stable/c/7a619f8c869117ffed08365b377f66b7e1d941b4"
        },
        {
          "url": "https://git.kernel.org/stable/c/db5a5406fb7e5337a074385c7a3e53c77f2c1bd3"
        }
      ],
      "title": "nvmet-fc: move lsop put work to nvmet_fc_ls_req_op",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-40171",
    "datePublished": "2025-11-12T10:46:52.289Z",
    "dateReserved": "2025-04-16T07:20:57.176Z",
    "dateUpdated": "2026-08-05T12:08:16.789Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2025-40171",
      "date": "2026-09-19",
      "epss": "0.00441",
      "percentile": "0.37767"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "drivers/nvme/target/fc.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "11269c08013f4ee8b8f5edc6c56700acb34092d0",
                    "status": "affected",
                    "version": "5e0bc09a52b6169ce90f7ac6e195791adb16cec4",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "a28112cc55013cd8cbd5d36b5115a5b851151bd9",
                    "status": "affected",
                    "version": "9e6987f8937a7bd7516aa52f25cb7e12c0c92ee8",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "060ecc81240ef9d60d9485a3a5eb55a0d6e7a25c",
                    "status": "affected",
                    "version": "eaf0971fdabf2a93c1429dc6bedf3bbe85dffa30",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "7331925c247b03b7767b8cd93cfe1b7aa2377850",
                    "status": "affected",
                    "version": "710c69dbaccdac312e32931abcb8499c1525d397",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "7a619f8c869117ffed08365b377f66b7e1d941b4",
                    "status": "affected",
                    "version": "710c69dbaccdac312e32931abcb8499c1525d397",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "db5a5406fb7e5337a074385c7a3e53c77f2c1bd3",
                    "status": "affected",
                    "version": "710c69dbaccdac312e32931abcb8499c1525d397",
                    "versionType": "git"
                  },
                  {
                    "status": "affected",
                    "version": "1d86f79287206deec36d63b89c741cf542b6cadd",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "5.15.195",
                    "status": "affected",
                    "version": "5.15.150",
                    "versionType": "semver"
                  },
                  {
                    "lessThan": "6.1.156",
                    "status": "affected",
                    "version": "6.1.80",
                    "versionType": "semver"
                  },
                  {
                    "lessThan": "6.6.112",
                    "status": "affected",
                    "version": "6.6.19",
                    "versionType": "semver"
                  },
                  {
                    "lessThan": "6.8",
                    "status": "affected",
                    "version": "6.7.7",
                    "versionType": "semver"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "drivers/nvme/target/fc.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "6.8"
                  },
                  {
                    "lessThan": "6.8",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.15.*",
                    "status": "unaffected",
                    "version": "5.15.195",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.1.*",
                    "status": "unaffected",
                    "version": "6.1.156",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.6.*",
                    "status": "unaffected",
                    "version": "6.6.112",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.12.*",
                    "status": "unaffected",
                    "version": "6.12.53",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.17.*",
                    "status": "unaffected",
                    "version": "6.17.3",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "6.18",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnvmet-fc: move lsop put work to nvmet_fc_ls_req_op\n\nIt\u2019s possible for more than one async command to be in flight from\n__nvmet_fc_send_ls_req. For each command, a tgtport reference is taken.\n\nIn the current code, only one put work item is queued at a time, which\nresults in a leaked reference.\n\nTo fix this, move the work item to the nvmet_fc_ls_req_op struct, which\nalready tracks all resources related to the command."
          }
        ],
        "id": "CVE-2025-40171",
        "lastModified": "2026-07-30T06:24:15.820",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "HIGH",
                "baseScore": 7.5,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "NONE",
                "integrityImpact": "NONE",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 3.9,
              "impactScore": 3.6,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            }
          ]
        },
        "published": "2025-11-12T11:15:47.513",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/060ecc81240ef9d60d9485a3a5eb55a0d6e7a25c"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/11269c08013f4ee8b8f5edc6c56700acb34092d0"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/7331925c247b03b7767b8cd93cfe1b7aa2377850"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/7a619f8c869117ffed08365b377f66b7e1d941b4"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/a28112cc55013cd8cbd5d36b5115a5b851151bd9"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/db5a5406fb7e5337a074385c7a3e53c77f2c1bd3"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Deferred"
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-07-30T08:47:41+00:00",
      "cve": "CVE-2025-40171",
      "id": "CVE-2025-40171",
      "initial_release_date": "2025-11-12T00:00:00+00:00",
      "product_status:known_affected": "232",
      "product_status:known_not_affected": "42",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: Kernel: Denial of Service in nvmet-fc due to resource leak",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-40171.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-08-31T13:47:29Z",
      "cve": "CVE-2025-40171",
      "id": "CVE-2025-40171",
      "initial_release_date": "2025-11-14T00:24:24Z",
      "product_status:first_fixed": "2",
      "product_status:known_affected": "461",
      "product_status:known_not_affected": "315",
      "product_status:recommended": "464",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2025-40171",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2025-40171.json",
      "version": "43"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.