---
id: CVE-2025-40171
title: 'nvmet-fc: move lsop put work to nvmet_fc_ls_req_op'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  nvmet-fc: move lsop put work to nvmet_fc_ls_req_op

  It’s possible for more than one async command to be in flight from
  __nvmet_fc_send_ls_req. For each command, a tgtpo…
severity: high
cvss: 7.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'
cvssSource: cna
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 5e0bc09a52b6169ce90f7ac6e195791adb16cec4 <
    11269c08013f4ee8b8f5edc6c56700acb34092d0
  - >-
    Linux >= 9e6987f8937a7bd7516aa52f25cb7e12c0c92ee8 <
    a28112cc55013cd8cbd5d36b5115a5b851151bd9
  - >-
    Linux >= eaf0971fdabf2a93c1429dc6bedf3bbe85dffa30 <
    060ecc81240ef9d60d9485a3a5eb55a0d6e7a25c
  - >-
    Linux >= 710c69dbaccdac312e32931abcb8499c1525d397 <
    7331925c247b03b7767b8cd93cfe1b7aa2377850
  - >-
    Linux >= 710c69dbaccdac312e32931abcb8499c1525d397 <
    7a619f8c869117ffed08365b377f66b7e1d941b4
  - >-
    Linux >= 710c69dbaccdac312e32931abcb8499c1525d397 <
    db5a5406fb7e5337a074385c7a3e53c77f2c1bd3
  - Linux 1d86f79287206deec36d63b89c741cf542b6cadd
  - Linux >= 5.15.150 < 5.15.195
  - Linux >= 6.1.80 < 6.1.156
  - Linux >= 6.6.19 < 6.6.112
  - Linux >= 6.7.7 < 6.8
  - Linux 6.8
ssvc:
  exploitation: none
  automatable: 'yes'
  technicalImpact: partial
  timestamp: '2026-10-15T21:57:33.774431Z'
published: '2025-11-12'
updated: '2026-10-15'
sourceUpdated: '2026-10-15T22:02:39.456Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2025-40171'
references:
  - url: 'https://git.kernel.org/stable/c/11269c08013f4ee8b8f5edc6c56700acb34092d0'
  - url: 'https://git.kernel.org/stable/c/a28112cc55013cd8cbd5d36b5115a5b851151bd9'
  - url: 'https://git.kernel.org/stable/c/060ecc81240ef9d60d9485a3a5eb55a0d6e7a25c'
  - url: 'https://git.kernel.org/stable/c/7331925c247b03b7767b8cd93cfe1b7aa2377850'
  - url: 'https://git.kernel.org/stable/c/7a619f8c869117ffed08365b377f66b7e1d941b4'
  - url: 'https://git.kernel.org/stable/c/db5a5406fb7e5337a074385c7a3e53c77f2c1bd3'
tags:
  - cve.org
epss: 0.00473
epssPercentile: 0.39349
ingestedAt: '2026-10-15T22:48:25.549Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

nvmet-fc: move lsop put work to nvmet_fc_ls_req_op

It’s possible for more than one async command to be in flight from
__nvmet_fc_send_ls_req. For each command, a tgtport reference is taken.

In the current code, only one put work item is queued at a time, which
results in a leaked reference.

To fix this, move the work item to the nvmet_fc_ls_req_op struct, which
already tracks all resources related to the command.

## Affected

- `Linux >= 5e0bc09a52b6169ce90f7ac6e195791adb16cec4 < 11269c08013f4ee8b8f5edc6c56700acb34092d0`
- `Linux >= 9e6987f8937a7bd7516aa52f25cb7e12c0c92ee8 < a28112cc55013cd8cbd5d36b5115a5b851151bd9`
- `Linux >= eaf0971fdabf2a93c1429dc6bedf3bbe85dffa30 < 060ecc81240ef9d60d9485a3a5eb55a0d6e7a25c`
- `Linux >= 710c69dbaccdac312e32931abcb8499c1525d397 < 7331925c247b03b7767b8cd93cfe1b7aa2377850`
- `Linux >= 710c69dbaccdac312e32931abcb8499c1525d397 < 7a619f8c869117ffed08365b377f66b7e1d941b4`
- `Linux >= 710c69dbaccdac312e32931abcb8499c1525d397 < db5a5406fb7e5337a074385c7a3e53c77f2c1bd3`
- `Linux 1d86f79287206deec36d63b89c741cf542b6cadd`
- `Linux >= 5.15.150 < 5.15.195`
- `Linux >= 6.1.80 < 6.1.156`
- `Linux >= 6.6.19 < 6.6.112`
- `Linux >= 6.7.7 < 6.8`
- `Linux 6.8`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.