CVE-2025-40171 Details
Description
In the Linux kernel, the following vulnerability has been resolved: nvmet-fc: move lsop put work to nvmet_fc_ls_req_op It’s possible for more than one async command to be in flight from __nvmet_fc_send_ls_req. For each command, a tgtport reference is taken. In the current code, only one put work item is queued at a time, which results in a leaked reference. To fix this, move the work item to the nvmet_fc_ls_req_op struct, which already tracks all resources related to the command.
A vulnerability in the nvmet-fc component of the Linux kernel can lead to a reference leak. This issue arises because, in the current implementation, only one work item is processed at a time, allowing for multiple asynchronous commands to be in flight simultaneously. Each command takes a reference for the target port, but the work item responsible for releasing this reference is not properly managed, causing a leak. The vulnerability has been addressed by moving the work item to the nvmet_fc_ls_req_op structure, which already tracks all related resources, ensuring that references are correctly released.
Users can upgrade to the latest version of the Linux kernel where this vulnerability has been fixed. Instructions for downloading the patched version are available on the official Linux kernel website.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Nov 12, 2025References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://git.kernel.org/stable/c/060ecc81240ef9d60d9485a3a5eb55a0d6e7a25c | kernel.org | Source CodeVendor |
| https://git.kernel.org/stable/c/11269c08013f4ee8b8f5edc6c56700acb34092d0 | kernel.org | Source CodeVendor |
| https://git.kernel.org/stable/c/7331925c247b03b7767b8cd93cfe1b7aa2377850 | kernel.org | Source CodeVendor |
| https://git.kernel.org/stable/c/7a619f8c869117ffed08365b377f66b7e1d941b4 | kernel.org | Source CodeVendor |
| https://git.kernel.org/stable/c/a28112cc55013cd8cbd5d36b5115a5b851151bd9 | kernel.org | Source CodeVendor |
| https://git.kernel.org/stable/c/db5a5406fb7e5337a074385c7a3e53c77f2c1bd3 | kernel.org | Source CodeVendor |
Weakness Enumeration
No weakness enumeration is available for this CVE.
Affected Products
| Product | Versions |
|---|---|
| Linux kernel | All versions |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 30, 2026 | CVE Modified | kernel.org |
| Jun 17, 2026 | CVE Modified | kernel.org |
| Nov 12, 2025 | New CVE Received | kernel.org |