CVE-2025-40343

nvmet-fc: avoid scheduling association deletion twice

State: Published
Severity: 9.8 Critical
Published: Dec 9, 2025
Updated: Oct 15, 2026
Reserved: Apr 16, 2025

Description

In the Linux kernel, the following vulnerability has been resolved:

nvmet-fc: avoid scheduling association deletion twice

When forcefully shutting down a port via the configfs interface, nvmet_port_subsys_drop_link() first calls nvmet_port_del_ctrls() and then nvmet_disable_port(). Both functions will eventually schedule all remaining associations for deletion.

The current implementation checks whether an association is about to be removed, but only after the work item has already been scheduled. As a result, it is possible for the first scheduled work item to free all resources, and then for the same work item to be scheduled again for deletion.

Because the association list is an RCU list, it is not possible to take a lock and remove the list entry directly, so it cannot be looked up again. Instead, a flag (terminating) must be used to determine whether the association is already in the process of being deleted.

Scores

CVSS	Score	Vector	Source
3.1	9.8 Critical	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	Linux

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	a07b4970f464f13640e28e16dad6cfa33647cc99 to before 2f4852db87e25d4e226b25cb6f652fef9504360eAffected a07b4970f464f13640e28e16dad6cfa33647cc99 to before 85e2ce1920cb511d57aae59f0df6ff85b28bf04dAffected a07b4970f464f13640e28e16dad6cfa33647cc99 to before 601ed47b2363c24d948d7bac0c23abc8bd459570Affected a07b4970f464f13640e28e16dad6cfa33647cc99 to before 04d17540ef51e2c291eb863ca87fd332259b2d40Affected a07b4970f464f13640e28e16dad6cfa33647cc99 to before c09ac9a63fc3aaf4670ad7b5e4f5afd764424154Affected a07b4970f464f13640e28e16dad6cfa33647cc99 to before f2537be4f8421f6495edfa0bc284d722f253841dAffected
LinuxLinux	4.8Affected before 4.8Not affected 5.15.197 through 5.15.Not affected 6.1.159 through 6.1.Not affected 6.6.117 through 6.6.Not affected 6.12.58 through 6.12.Not affected 6.17.8 through 6.17.*Not affected 6.18 and laterNot affected

Product

Versions

LinuxLinux

a07b4970f464f13640e28e16dad6cfa33647cc99 to before 2f4852db87e25d4e226b25cb6f652fef9504360eAffected
a07b4970f464f13640e28e16dad6cfa33647cc99 to before 85e2ce1920cb511d57aae59f0df6ff85b28bf04dAffected
a07b4970f464f13640e28e16dad6cfa33647cc99 to before 601ed47b2363c24d948d7bac0c23abc8bd459570Affected
a07b4970f464f13640e28e16dad6cfa33647cc99 to before 04d17540ef51e2c291eb863ca87fd332259b2d40Affected
a07b4970f464f13640e28e16dad6cfa33647cc99 to before c09ac9a63fc3aaf4670ad7b5e4f5afd764424154Affected
a07b4970f464f13640e28e16dad6cfa33647cc99 to before f2537be4f8421f6495edfa0bc284d722f253841dAffected

LinuxLinux

4.8Affected
before 4.8Not affected
5.15.197 through 5.15.*Not affected
6.1.159 through 6.1.*Not affected
6.6.117 through 6.6.*Not affected
6.12.58 through 6.12.*Not affected
6.17.8 through 6.17.*Not affected
6.18 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.