Denial of Service in Linux Kernel nvme-fc Module

CVE-2025-40261

What is CVE-2025-40261?

A vulnerability exists in the Linux kernel's nvme-fc module, where the improper cancellation of I/O error work can lead to system instability. Specifically, in the nvme_fc_delete_ctrl function, the cancellation of the ->ioerr_work must occur after the nvme_fc_delete_association function is called. Failure to do so can result in a list_del corruption, causing kernel crashes and impacting system performance, especially under heavy I/O operations.

References