{"id":"CVE-2025-40171","title":"nvmet-fc: move lsop put work to nvmet_fc_ls_req_op","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nnvmet-fc: move lsop put work to nvmet_fc_ls_req_op\n\nIt’s possible for more than one async command to be in flight from\n__nvmet_fc_send_ls_req. For each command, a tgtpo…","severity":"high","cvss":7.5,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","cvssSource":"cna","vendor":"Linux","product":"Linux","affected":["Linux >= 5e0bc09a52b6169ce90f7ac6e195791adb16cec4 < 11269c08013f4ee8b8f5edc6c56700acb34092d0","Linux >= 9e6987f8937a7bd7516aa52f25cb7e12c0c92ee8 < a28112cc55013cd8cbd5d36b5115a5b851151bd9","Linux >= eaf0971fdabf2a93c1429dc6bedf3bbe85dffa30 < 060ecc81240ef9d60d9485a3a5eb55a0d6e7a25c","Linux >= 710c69dbaccdac312e32931abcb8499c1525d397 < 7331925c247b03b7767b8cd93cfe1b7aa2377850","Linux >= 710c69dbaccdac312e32931abcb8499c1525d397 < 7a619f8c869117ffed08365b377f66b7e1d941b4","Linux >= 710c69dbaccdac312e32931abcb8499c1525d397 < db5a5406fb7e5337a074385c7a3e53c77f2c1bd3","Linux 1d86f79287206deec36d63b89c741cf542b6cadd","Linux >= 5.15.150 < 5.15.195","Linux >= 6.1.80 < 6.1.156","Linux >= 6.6.19 < 6.6.112","Linux >= 6.7.7 < 6.8","Linux 6.8"],"ssvc":{"exploitation":"none","automatable":"yes","technicalImpact":"partial","timestamp":"2026-10-15T21:57:33.774431Z"},"published":"2025-11-12","updated":"2026-10-15","sourceUpdated":"2026-10-15T22:02:39.456Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2025-40171","references":[{"url":"https://git.kernel.org/stable/c/11269c08013f4ee8b8f5edc6c56700acb34092d0"},{"url":"https://git.kernel.org/stable/c/a28112cc55013cd8cbd5d36b5115a5b851151bd9"},{"url":"https://git.kernel.org/stable/c/060ecc81240ef9d60d9485a3a5eb55a0d6e7a25c"},{"url":"https://git.kernel.org/stable/c/7331925c247b03b7767b8cd93cfe1b7aa2377850"},{"url":"https://git.kernel.org/stable/c/7a619f8c869117ffed08365b377f66b7e1d941b4"},{"url":"https://git.kernel.org/stable/c/db5a5406fb7e5337a074385c7a3e53c77f2c1bd3"}],"tags":["cve.org"],"epss":0.00473,"epssPercentile":0.39349,"ingestedAt":"2026-10-15T22:48:25.549Z","slug":"CVE-2025-40171","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nnvmet-fc: move lsop put work to nvmet_fc_ls_req_op\n\nIt’s possible for more than one async command to be in flight from\n__nvmet_fc_send_ls_req. For each command, a tgtport reference is taken.\n\nIn the current code, only one put work item is queued at a time, which\nresults in a leaked reference.\n\nTo fix this, move the work item to the nvmet_fc_ls_req_op struct, which\nalready tracks all resources related to the command.\n\n## Affected\n\n- `Linux >= 5e0bc09a52b6169ce90f7ac6e195791adb16cec4 < 11269c08013f4ee8b8f5edc6c56700acb34092d0`\n- `Linux >= 9e6987f8937a7bd7516aa52f25cb7e12c0c92ee8 < a28112cc55013cd8cbd5d36b5115a5b851151bd9`\n- `Linux >= eaf0971fdabf2a93c1429dc6bedf3bbe85dffa30 < 060ecc81240ef9d60d9485a3a5eb55a0d6e7a25c`\n- `Linux >= 710c69dbaccdac312e32931abcb8499c1525d397 < 7331925c247b03b7767b8cd93cfe1b7aa2377850`\n- `Linux >= 710c69dbaccdac312e32931abcb8499c1525d397 < 7a619f8c869117ffed08365b377f66b7e1d941b4`\n- `Linux >= 710c69dbaccdac312e32931abcb8499c1525d397 < db5a5406fb7e5337a074385c7a3e53c77f2c1bd3`\n- `Linux 1d86f79287206deec36d63b89c741cf542b6cadd`\n- `Linux >= 5.15.150 < 5.15.195`\n- `Linux >= 6.1.80 < 6.1.156`\n- `Linux >= 6.6.19 < 6.6.112`\n- `Linux >= 6.7.7 < 6.8`\n- `Linux 6.8`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"twilight","depthScore":41,"depthScoreParts":{"impact":41.3,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}