Executive brief
A vulnerability in the Linux kernel's NVMe-over-Fibre Channel (NVMe-oFC) target driver could allow a system crash or instability. When a storage port is forcefully shut down, the system may attempt to delete the same internal connection resources twice. This race condition can lead to memory corruption, potentially impacting the availability and reliability of storage services.
Technical details
A race condition exists in the nvmet-fc (NVMe over Fibre Channel target) driver within the Linux kernel. When shutting down a port via configfs, both nvmet_port_del_ctrls() and nvmet_disable_port() may attempt to schedule the same association for deletion. Because the check for an existing removal process occurred after the work item was already queued, a second work item could be scheduled to free resources that were already released by the first. This is a classic double-free or use-after-free scenario caused by improper synchronization in an RCU-protected list. The fix introduces an atomic 'terminating' flag to ensure the deletion work is only scheduled once. Patches are available in various stable kernel branches including 5.15.y, 6.1.y, 6.6.y, and 6.12.y.
Affected products
- Linux Linux Kernel 4.8 to 5.15.197, 6.1.159, 6.6.117, 6.12.58, 6.17.8
Timeline
- 2025-09-02: other: Initial patch authored
- 2025-12-09: advisory: CVE-2025-40343 published
References
- https://git.kernel.org/stable/c/04d17540ef51e2c291eb863ca87fd332259b2d40
- https://git.kernel.org/stable/c/2f4852db87e25d4e226b25cb6f652fef9504360e
- https://git.kernel.org/stable/c/601ed47b2363c24d948d7bac0c23abc8bd459570
- https://git.kernel.org/stable/c/85e2ce1920cb511d57aae59f0df6ff85b28bf04d
- https://git.kernel.org/stable/c/c09ac9a63fc3aaf4670ad7b5e4f5afd764424154
- https://git.kernel.org/stable/c/f2537be4f8421f6495edfa0bc284d722f253841d