Linux Kernel CVE-2025-40171

In the Linux kernel, the following vulnerability has been resolved:

nvmet-fc: move lsop put work to nvmet_fc_ls_req_op

It’s possible for more than one async command to be in flight from __nvmet_fc_send_ls_req. For each command, a tgtport reference is taken.

In the current code, only one put work item is queued at a time, which results in a leaked reference.

To fix this, move the work item to the nvmet_fc_ls_req_op struct, which already tracks all resources related to the command.

The affected product is the Linux kernel, specifically the nvmet-fc NVMe-over-Fabrics Fibre Channel target driver. Exact affected version ranges are not enumerated in the provided data (NVD CPE strings were not supplied); the six git.kernel.org stable commit references (e.g. 060ecc81240ef9d60d9485a3a5eb55a0d6e7a25c and db5a5406fb7e5337a074385c7a3e53c77f2c1bd3) indicate the fix was backported across multiple stable branches. Distribution exposure is confirmed for Ubuntu via advisories USN-8126-1 (https://ubuntu.com/security/notices/USN-8126-1) and USN-8125-1 (https://ubuntu.com/security/notices/USN-8125-1), which enumerate the specific Ubuntu kernel package versions fixed. Only systems built with CONFIG_NVME_TARGET_FC and actively configured as FC targets exercise the vulnerable path.