Race Condition in Linux Kernel's NVMe-FC Component

CVE-2025-40342

What is CVE-2025-40342?

A race condition exists in the NVMe-FC component of the Linux kernel related to remote port management. Specifically, the function nvme_fc_unregister_remote can remove a remote port from an lport object while the system may still be attempting to reconnect due to the lack of a lock when checking the port_state. This can lead to inconsistencies within the driver, jeopardizing the stability and security of the system. Proper locking mechanisms need to be implemented to protect shared state during concurrent operations to mitigate this vulnerability.

References