In the Linux kernel, the following vulnerability has been resolved:

nvme-fc: use lock accessing port_state and rport state

nvme_fc_unregister_remote removes the remote port on a lport object at
any point in time when there is no active association. This races with
with the reconnect logic, because nvme_fc_create_association is not
taking a lock to check the port_state and atomically increase the
active count on the rport.

No CVSS v4.0

Attack Vector Local

Attack Complexity High

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00053.

Key SSVC decision points have not yet been added.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions
Linux Linux unaffected
Version Status Constraints
e399441de9115cd472b8ace6c517708273ca7997 affected
< de3d91af47bc015031e7721b100a29989f6498a5
e399441de9115cd472b8ace6c517708273ca7997 affected
< e8cde03de8674b05f2c5e0870729049eba517800
e399441de9115cd472b8ace6c517708273ca7997 affected
< 4253e0a4546138a2bf9cb6acf66b32fee677fc7c
e399441de9115cd472b8ace6c517708273ca7997 affected
< 25f4bf1f7979a7871974fd36c79d69ff1cf4b446
e399441de9115cd472b8ace6c517708273ca7997 affected
< 9950af4303942081dc8c7a5fdc3688c17c7eb6c0
e399441de9115cd472b8ace6c517708273ca7997 affected
< a2f7fa75c4a2a07328fa22ccbef461db76790b55
e399441de9115cd472b8ace6c517708273ca7997 affected
< 891cdbb162ccdb079cd5228ae43bdeebce8597ad
Linux Linux affected
Version Status Constraints
4.10 affected
—
0 unaffected
< 4.10
5.10.247 unaffected
≤ 5.10.*
5.15.197 unaffected
≤ 5.15.*
6.1.159 unaffected
≤ 6.1.*
6.6.117 unaffected
≤ 6.6.*
6.12.58 unaffected
≤ 6.12.*
6.17.8 unaffected
≤ 6.17.*
6.18 unaffected
≤ *

No data.

No data.

No data.

Subscriptions

Vendors Products
Linux Subscribe
Linux Kernel Subscribe

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
Debian DLA Debian DLA DLA-4404-1 linux security update
Debian DLA Debian DLA DLA-4436-1 linux-6.1 security update
Ubuntu USN Ubuntu USN USN-8029-1 Linux kernel vulnerabilities
Ubuntu USN Ubuntu USN USN-8030-1 Linux kernel (GCP) vulnerabilities
Ubuntu USN Ubuntu USN USN-8029-2 Linux kernel vulnerabilities
Ubuntu USN Ubuntu USN USN-8048-1 Linux kernel (OEM) vulnerabilities
Ubuntu USN Ubuntu USN USN-8029-3 Linux kernel (Azure) vulnerabilities
Ubuntu USN Ubuntu USN USN-8095-1 Linux kernel vulnerabilities
Ubuntu USN Ubuntu USN USN-8096-1 Linux kernel vulnerabilities
Ubuntu USN Ubuntu USN USN-8095-2 Linux kernel (FIPS) vulnerabilities
Ubuntu USN Ubuntu USN USN-8096-2 Linux kernel (FIPS) vulnerabilities
Ubuntu USN Ubuntu USN USN-8100-1 Linux kernel (NVIDIA) vulnerabilities
Ubuntu USN Ubuntu USN USN-8095-3 Linux kernel (Real-time) vulnerabilities
Ubuntu USN Ubuntu USN USN-8096-3 Linux kernel vulnerabilities
Ubuntu USN Ubuntu USN USN-8096-4 Linux kernel (Real-time) vulnerabilities
Fixes

Solution

No solution given by the vendor.

Workaround

No workaround given by the vendor.

References
Link Providers
https://git.kernel.org/stable/c/25f4bf1f7979a7871974fd36c79d69ff1cf4b446 cve-icon cve-icon
https://git.kernel.org/stable/c/4253e0a4546138a2bf9cb6acf66b32fee677fc7c cve-icon cve-icon
https://git.kernel.org/stable/c/891cdbb162ccdb079cd5228ae43bdeebce8597ad cve-icon cve-icon
https://git.kernel.org/stable/c/9950af4303942081dc8c7a5fdc3688c17c7eb6c0 cve-icon cve-icon
https://git.kernel.org/stable/c/a2f7fa75c4a2a07328fa22ccbef461db76790b55 cve-icon cve-icon
https://git.kernel.org/stable/c/de3d91af47bc015031e7721b100a29989f6498a5 cve-icon cve-icon
https://git.kernel.org/stable/c/e8cde03de8674b05f2c5e0870729049eba517800 cve-icon cve-icon
https://lore.kernel.org/linux-cve-announce/2025120912-CVE-2025-40342-a237@gregkh/T cve-icon
https://nvd.nist.gov/vuln/detail/CVE-2025-40342 cve-icon
https://www.cve.org/CVERecord?id=CVE-2025-40342 cve-icon
History

Wed, 10 Dec 2025 00:15:00 +0000

Type Values Removed Values Added
References
Metrics threat_severity

None

 cvssV3_1

{'score': 7.0, 'vector': 'CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H'}

threat_severity

Important

Tue, 09 Dec 2025 04:30:00 +0000

Type Values Removed Values Added
Description In the Linux kernel, the following vulnerability has been resolved: nvme-fc: use lock accessing port_state and rport state nvme_fc_unregister_remote removes the remote port on a lport object at any point in time when there is no active association. This races with with the reconnect logic, because nvme_fc_create_association is not taking a lock to check the port_state and atomically increase the active count on the rport.
Title nvme-fc: use lock accessing port_state and rport state
First Time appeared Linux
Linux linux Kernel
CPEs cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Vendors & Products Linux
Linux linux Kernel
References
cve-icon MITRE

Status: PUBLISHED

Assigner: Linux

Published:

Updated: 2025-12-20T08:52:12.515Z

Reserved: 2025-04-16T07:20:57.187Z

Link: CVE-2025-40342

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Awaiting Analysis

Published: 2025-12-09T16:17:44.517

Modified: 2025-12-09T18:36:53.557

Link: CVE-2025-40342

cve-icon Redhat

Severity : Important

Publid Date: 2025-12-09T00:00:00Z

Links: CVE-2025-40342 - Bugzilla

cve-icon OpenCVE Enrichment

No data.

Weaknesses

No weakness.