CVE-2025-40342
Unknown Unknown - Not Provided
BaseFortify

Publication date: 2025-12-09

Last updated on: 2025-12-09

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: nvme-fc: use lock accessing port_state and rport state nvme_fc_unregister_remote removes the remote port on a lport object at any point in time when there is no active association. This races with with the reconnect logic, because nvme_fc_create_association is not taking a lock to check the port_state and atomically increase the active count on the rport.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2025-12-09
Last Modified
2025-12-09
Generated
2026-06-16
AI Q&A
2025-12-09
EPSS Evaluated
2026-06-15
NVD
CVE-2025-40342
Affected Vendors & Products
Showing 1 associated CPE
Vendor Product Version / Range
linux linux_kernel *
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Executive Summary

This vulnerability in the Linux kernel's nvme-fc subsystem involves a race condition between removing a remote port and reconnecting it. Specifically, the function nvme_fc_unregister_remote can remove a remote port from a local port object when there is no active association, but the reconnect logic (nvme_fc_create_association) does not properly lock the port state to check and update the active count atomically. This can lead to inconsistent states or unexpected behavior.

Impact Analysis

The vulnerability can cause race conditions that may lead to instability or unexpected behavior in the NVMe over Fibre Channel subsystem of the Linux kernel. This could potentially result in loss of connectivity or data access issues related to NVMe devices over Fibre Channel networks.

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2025-40342. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart