Executive brief
A vulnerability was identified in the Linux kernel's NVMe over Fibre Channel (NVMe-FC) driver. This component is responsible for managing high-speed storage connections over Fibre Channel networks. A race condition in how the system handles port reconnections could lead to system instability or unauthorized data access by an attacker on the same local network.
Technical details
A race condition exists in the NVMe-FC host driver (drivers/nvme/host/fc.c) within the Linux kernel. The function 'nvme_fc_unregister_remote' can remove a remote port object while 'nvme_fc_create_association' is attempting to reconnect, because the latter fails to acquire the necessary lock when checking 'port_state' and incrementing the active count on the 'rport'. This lack of synchronization can lead to use-after-free scenarios or inconsistent state transitions. The vulnerability is reachable via the adjacent network (Fibre Channel fabric). Patches have been released across multiple stable kernel branches including 5.10.y, 5.15.y, 6.1.y, 6.6.y, and 6.12.y.
Affected products
- Linux Linux Kernel 4.10 to 6.17.8
Timeline
- 2025-09-02: patched: Initial fix authored by Daniel Wagner
- 2025-12-09: disclosed: CVE-2025-40342 published
References
- https://git.kernel.org/stable/c/25f4bf1f7979a7871974fd36c79d69ff1cf4b446
- https://git.kernel.org/stable/c/4253e0a4546138a2bf9cb6acf66b32fee677fc7c
- https://git.kernel.org/stable/c/891cdbb162ccdb079cd5228ae43bdeebce8597ad
- https://git.kernel.org/stable/c/9950af4303942081dc8c7a5fdc3688c17c7eb6c0
- https://git.kernel.org/stable/c/a2f7fa75c4a2a07328fa22ccbef461db76790b55
- https://git.kernel.org/stable/c/de3d91af47bc015031e7721b100a29989f6498a5
- https://git.kernel.org/stable/c/e8cde03de8674b05f2c5e0870729049eba517800