Executive brief
A vulnerability in the Linux kernel's NVMe-over-Fibre Channel (NVMe-FC) target driver could allow a remote attacker to cause a denial-of-service condition. The issue stems from improper resource management when handling multiple simultaneous commands, which can lead to memory or reference leaks. Over time, this could exhaust system resources and cause the affected server to become unstable or crash.
Technical details
A reference counting vulnerability exists in the Linux kernel's NVMe-over-Fibre Channel (NVMe-FC) target implementation (drivers/nvme/target/fc.c). The function __nvmet_fc_send_ls_req takes a tgtport reference for each asynchronous command, but the driver previously only queued one 'put' work item at a time. This logic error results in leaked tgtport references when multiple commands are in flight. An attacker could potentially trigger this leak to exhaust system resources, leading to a kernel-level denial of service. The fix involves moving the work item to the nvmet_fc_ls_req_op struct to ensure each command's resources are tracked and released individually.
Affected products
- Linux Linux Kernel 5.15.150 to 5.15.195, 6.1.80 to 6.1.156, 6.6.19 to 6.6.112, 6.7.7 to 6.8
Timeline
- 2025-11-12: advisory: CVE-2025-40171 published by NVD/kernel.org
References
- https://git.kernel.org/stable/c/060ecc81240ef9d60d9485a3a5eb55a0d6e7a25c
- https://git.kernel.org/stable/c/11269c08013f4ee8b8f5edc6c56700acb34092d0
- https://git.kernel.org/stable/c/7331925c247b03b7767b8cd93cfe1b7aa2377850
- https://git.kernel.org/stable/c/7a619f8c869117ffed08365b377f66b7e1d941b4
- https://git.kernel.org/stable/c/a28112cc55013cd8cbd5d36b5115a5b851151bd9
- https://git.kernel.org/stable/c/db5a5406fb7e5337a074385c7a3e53c77f2c1bd3