CVE-2025-40343
A flaw in the Linux kernel's NVMe over Fabrics target (nvmet-fc) could cause an association deletion work item to be scheduled twice when a port is forcefully shut down via configfs. Because the association list is an RCU list, the second scheduling could operate on already‑freed memory, leading to a use‑free condition that might allow privilege escalation or denial of service. The issue has been fixed by adding a terminating flag to prevent double scheduling.
An official fix is available, so this entry is kept for 30 days and then removed automatically.
Who is affected
Linux systems using the NVMe over Fabrics target (nvmet-fc) feature.
Real-world impact
An attacker with the ability to trigger a forceful port shutdown could potentially execute arbitrary code with kernel privileges or crash the system.
Why this severity
The CVSS v3.1 base score is 9.8 (Critical) due to network‑adjacent attack vector, low complexity, no privileges or user interaction required, and high impact on confidentiality, integrity, and availability.
What to do about it
- 011. Obtain the Linux kernel patch that resolves CVE-2025-40343 from your distribution's security updates.
- 022. Install or update the kernel according to your vendor's instructions.
- 033. Reboot the system to load the patched kernel.
NVD description states the vulnerability has been resolved in the Linux kernel.
Timeline
- Dec 9, 2025 · Dec 9, 2025PublishedDisclosed and added to the National Vulnerability Database.
- Jul 30, 2026 · 6d agoAdvisory updatedThe NVD record was last revised.
- Jul 30, 2026 · 6d agoOfficial fix availableA vendor patch or mitigation now exists — see the remediation steps above.