CVE-2025-40342: nvme-fc: use lock accessing port_state and rport state
In the Linux kernel, the following vulnerability has been resolved:
nvme-fc: use lock accessing portstate and rport state
nvmefcunregisterremote removes the remote port on a lport object at any point in time when there is no active association. This races with with the reconnect logic, because nvmefccreateassociation is not taking a lock to check the portstate and atomically increase the active count on the rport.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-40342?
CVE-2025-40342 has been classified as medium severity due to potential race conditions in the NVMe over Fibre Channel driver.
How do I fix CVE-2025-40342?
To fix CVE-2025-40342, update the Linux kernel to the latest version that includes the patch addressing this vulnerability.
What components are affected by CVE-2025-40342?
CVE-2025-40342 affects the NVMe over Fibre Channel (nvme-fc) component of the Linux kernel.
Is CVE-2025-40342 exploitable?
CVE-2025-40342 can be exploited if an attacker can trigger race conditions during remote port management, leading to potential system instability.
When was CVE-2025-40342 disclosed?
CVE-2025-40342 was disclosed alongside updates in kernel versions that include fixes for this vulnerability.