Skip to main content

Linux Kernel CVE-2025-40342

HIGH
2025-12-09 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Information Disclosure Linux Red Hat Suse
8.8
CVSS 3.1 · Vendor: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Share

Severity by source

Vendor (416baaa9-dc9f-4396-8d5f-8c081fb06d67) PRIMARY
8.8 HIGH
AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
vuln.today AI
5.9 MEDIUM

Timing-dependent race on the FC transport gives AC:H; needs an operational NVMe-FC host/fabric position (AV:A, PR:L); primary realistic impact is DoS (A:H) with limited memory disclosure/corruption (C:L/I:L).

3.1 AV:A/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:H
4.0 AV:A/AC:H/AT:P/PR:L/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N
SUSE
6.4 MEDIUM
AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H
Red Hat
4.7 MEDIUM
qualitative

Primary rating from Vendor (416baaa9-dc9f-4396-8d5f-8c081fb06d67).

CVSS VectorVendor: 416baaa9-dc9f-4396-8d5f-8c081fb06d67

Attack Vector
Adjacent
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

2
Analysis Generated
Jul 30, 2026 - 07:35 vuln.today
CVE Published
Dec 09, 2025 - 16:17 cve.org
HIGH 8.8

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

nvme-fc: use lock accessing port_state and rport state

nvme_fc_unregister_remote removes the remote port on a lport object at any point in time when there is no active association. This races with with the reconnect logic, because nvme_fc_create_association is not taking a lock to check the port_state and atomically increase the active count on the rport.

AnalysisAI

Denial of service and potential memory corruption in the Linux kernel's NVMe over Fibre Channel (nvme-fc) transport arises because nvme_fc_create_association reads the remote port_state and increments the rport active count without holding a lock, racing against nvme_fc_unregister_remote which can free the remote port when no active association exists. An attacker or fault condition on the FC fabric able to trigger reconnect events concurrently with port teardown can drive a use-after-free style condition on the rport object. There is no public exploit identified at time of analysis and this is not listed in CISA KEV; EPSS is low at 0.21% (11th percentile).

Technical ContextAI

The flaw lives in the NVMe-oF Fibre Channel host driver (drivers/nvme/host/fc.c), which manages local ports (lport) and remote ports (rport) representing NVMe targets reachable over an FC SAN. Association lifecycle and reconnect logic must coordinate with dynamic port registration/unregistration events delivered by the FC transport. The root cause is a classic concurrency defect (CWE-362, Race Condition; the input lists CWE as N/A) - the reconnect path checks port_state and bumps the active reference counter non-atomically and without the rport lock, so a teardown that removes the remote port can interleave, invalidating state the reconnect path relies on. The upstream fix serializes access to port_state and rport state under the appropriate lock so the state check and refcount increment are atomic.

Affected ProductsAI

The Linux kernel's nvme-fc (NVMe over Fibre Channel) host transport is affected across multiple stable series; specific vulnerable-to-fixed boundaries are defined by the seven stable-tree fix commits rather than a single tagged release. Exact affected versions are not enumerated in the provided data (no CPE strings supplied), so administrators should map the fix commits (git.kernel.org/stable/c/25f4bf1f, 4253e0a4, 891cdbb1, 9950af43, a2f7fa75, de3d91af, e8cde03d) against their running kernel and distribution backports. Only systems that actually build and use the nvme-fc driver with Fibre Channel HBAs attached to NVMe-oF targets are exposed.

RemediationAI

Upstream fix available (multiple stable-tree commits); a single released patched version is not specified in the input, so update to your distribution's kernel that incorporates the corresponding backport - cross-reference the commits at https://git.kernel.org/stable/c/e8cde03de8674b05f2c5e0870729049eba517800 (and the six sibling commits 25f4bf1f, 4253e0a4, 891cdbb1, 9950af43, a2f7fa75, de3d91af) to identify the minimum fixed point for your series. Where immediate patching of production SAN hosts is not possible, reduce exposure by avoiding conditions that trigger frequent remote-port register/unregister churn concurrent with reconnects - for example minimize fabric flapping, stabilize FC connectivity, and schedule reconnect-inducing maintenance during low-activity windows; note these are operational risk-reduction measures only and do not remove the race. If NVMe-FC is not required, not loading/building the nvme-fc module eliminates the affected code path entirely at the cost of losing NVMe-over-FC connectivity.

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
Container suse/sl-micro/6.0/baremetal-os-container:latest Affected
Container suse/sl-micro/6.0/base-os-container:2.1.3-7.95 Image SL-Micro Affected
Container suse/sl-micro/6.0/kvm-os-container:2.1.3-6.115 Affected
Container suse/sl-micro/6.0/rt-os-container:2.1.3-7.146 Affected
Container suse/sl-micro/6.0/toolbox:latest Affected

Share

CVE-2025-40342 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy