CVE-2025-40343

A flaw was found in the Linux kernel's NVMe over Fibre Channel (nvmet-fc) target subsystem. When forcefully shutting down a port through the configfs interface, both nvmet_port_del_ctrls() and nvmet_disable_port() schedule association deletions. Due to insufficient synchronization, the same work item can be scheduled twice, leading to a double-free condition where resources are freed by the first work item and then the same work item attempts to free them again. This can cause memory corruption, system crashes, or potentially be exploited for privilege escalation.

This vulnerability affects systems configured as NVMe over Fibre Channel targets. Exploitation requires local access with permissions to manage the nvmet-fc configfs interface. The race condition occurs during port shutdown operations.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

To mitigate this issue, prevent the nvmet_fc module from being loaded if NVMe over Fibre Channel target functionality is not required. See https://access.redhat.com/solutions/41278 for instructions on how to blacklist a kernel module.