CVE-2025-40342

In the Linux kernel, the following vulnerability has been resolved:

nvme-fc: use lock accessing port_state and rport state

nvme_fc_unregister_remote removes the remote port on a lport object at any point in time when there is no active association. This races with with the reconnect logic, because nvme_fc_create_association is not taking a lock to check the port_state and atomically increase the active count on the rport.

This flaw is rated as a Moderate severity impact rather than Important because triggering the race condition requires specific timing during NVMe over Fibre Channel reconnection events and results only in a denial of service (system crash) without compromising confidentiality or integrity. Standard Red Hat Enterprise Linux installations do not load or configure the NVMe-oF Fibre Channel transport driver by default, limiting exposure strictly to systems actively attached to Fibre Channel storage fabrics. Environments that do not utilize NVMe over Fibre Channel infrastructure are unaffected in practice.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.