CVE-2025-40171: nvmet-fc: move lsop put work to nvmet_fc_ls_req_op

Severity: high (CVSS 7.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.5% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2025-11-12 · updated 2026-10-19

Description

In the Linux kernel, the following vulnerability has been resolved: nvmet-fc: move lsop put work to nvmet_fc_ls_req_op It’s possible for more than one async command to be in flight from __nvmet_fc_send_ls_req. For each command, a tgtport reference is taken. In the current code, only one put work item is queued at a time, which results in a leaked reference. To fix this, move the work item to the nvmet_fc_ls_req_op struct, which already tracks all resources related to the command.

Affected products

Linux kernel: from 5.15.150 before 5.15.195; from 6.1.80 before 6.1.156; from 6.6.19 before 6.6.112; from 6.7.7 before 6.8; 6.8 — fixed in 5.15.195, 6.1.156, 6.18, 6.6.112, 6.8

How to fix

Upgrade to a fixed version: Linux kernel 5.15.195, 6.1.156, 6.18, 6.6.112. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2025-40171 or the next vulnerability affects your stack