Linux Kernel Vulnerability in NVMe over Fibre Channel Interface

CVE-2025-40343

What is CVE-2025-40343?

A vulnerability exists within the NVMe over Fibre Channel implementation of the Linux kernel. Specifically, improper handling during the shutdown of a port can lead to the scheduling of deletion actions for associations more than once. This issue arises when functions responsible for deleting controller associations inadvertently allow for double scheduling, which could lead to resource mismanagement. The flaw is due to inadequate tracking of associations during the deletion process, exacerbated by the absence of locking mechanisms due to the RCU list nature of the association list. A termination flag is necessary to manage the status of ongoing deletions effectively.

References