Executive brief
A vulnerability in the Linux kernel's NVMe over Fibre Channel (NVMe-FC) driver could allow a local user to cause a system crash. The issue occurs during the deletion of a storage controller, where background error-handling tasks are not properly stopped before the system attempts to free memory. This leads to memory corruption and a kernel panic, potentially disrupting operations and causing a denial of service.
Technical details
A use-after-free and list corruption vulnerability exists in the Linux kernel's NVMe-FC driver (drivers/nvme/host/fc.c). The function nvme_fc_delete_ctrl() originally called cancel_work_sync() for the ioerr_work workqueue before calling nvme_fc_delete_association(). However, nvme_fc_delete_association() waits for pending I/O, and subsequent I/O errors can re-queue ioerr_work after the initial cancellation. If this work runs after the nvme_fc_ctrl object is freed, it results in list_del corruption and a kernel BUG at lib/list_debug.c. The fix moves the cancellation call to after the association deletion to ensure no further work can be queued. This is a local denial-of-service vulnerability requiring the ability to trigger controller deletion or specific I/O error conditions.
Affected products
- Linux Linux kernel 6.12.0
Timeline
- 2025-11-17: patched: Initial fix committed to mainline kernel.
- 2025-12-04: disclosed: CVE-2025-40261 published.
References
- https://git.kernel.org/stable/c/0a2c5495b6d1ecb0fa18ef6631450f391a888256
- https://git.kernel.org/stable/c/33f64600a12055219bda38b55320c62cdeda9167
- https://git.kernel.org/stable/c/3f48cd7f35da07fc067cef926bb7f6f4735de37b
- https://git.kernel.org/stable/c/48ae433c6cc6985f647b1b37d8bb002972cf9bdb
- https://git.kernel.org/stable/c/9610a2c162ef729a3988213a4604376e492f6f44
- https://git.kernel.org/stable/c/a9b1315ed428239612601e9e188329e7cefa32fd
- https://git.kernel.org/stable/c/fbd5741a556eaaa63d0908132ca79d335b58b1cd