Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2025-40171— nvmet-fc: move lsop put work to nvmet_fc_ls_req_op

Quick assessment

Affected
Linux Linux
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Linux kernel是美国Linux基金会的开源操作系统Linux所使用的内核。 Linux kernel存在安全漏洞，该漏洞源于nvmet-fc未正确处理多个异步命令，可能导致资源泄漏。

CVSS 7.5 · High EPSS 0.47% · P40

Possible ATT&CK Techniques 1 AI

T1001 · Data Obfuscation

Affected Version Matrix 19

VendorProduct Version RangeStatus
Linux Linux 5e0bc09a52b6169ce90f7ac6e195791adb16cec4< 11269c08013f4ee8b8f5edc6c56700acb34092d0 affected
9e6987f8937a7bd7516aa52f25cb7e12c0c92ee8< a28112cc55013cd8cbd5d36b5115a5b851151bd9 affected
eaf0971fdabf2a93c1429dc6bedf3bbe85dffa30< 060ecc81240ef9d60d9485a3a5eb55a0d6e7a25c affected
710c69dbaccdac312e32931abcb8499c1525d397< 7331925c247b03b7767b8cd93cfe1b7aa2377850 affected
710c69dbaccdac312e32931abcb8499c1525d397< 7a619f8c869117ffed08365b377f66b7e1d941b4 affected
710c69dbaccdac312e32931abcb8499c1525d397< db5a5406fb7e5337a074385c7a3e53c77f2c1bd3 affected
1d86f79287206deec36d63b89c741cf542b6cadd affected
5.15.150< 5.15.195 affected
… +11 more rows
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2025-40171

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
nvmet-fc: move lsop put work to nvmet_fc_ls_req_op
Source: CVE Program / CVE List V5
Vulnerability Description
In the Linux kernel, the following vulnerability has been resolved: nvmet-fc: move lsop put work to nvmet_fc_ls_req_op It’s possible for more than one async command to be in flight from __nvmet_fc_send_ls_req. For each command, a tgtport reference is taken. In the current code, only one put work item is queued at a time, which results in a leaked reference. To fix this, move the work item to the nvmet_fc_ls_req_op struct, which already tracks all resources related to the command.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Vulnerability Title
Linux kernel 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Linux kernel是美国Linux基金会的开源操作系统Linux所使用的内核。 Linux kernel存在安全漏洞，该漏洞源于nvmet-fc未正确处理多个异步命令，可能导致资源泄漏。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor Product Affected Versions CPE Subscribe
Linux Linux 5e0bc09a52b6169ce90f7ac6e195791adb16cec4 ~ 11269c08013f4ee8b8f5edc6c56700acb34092d0 -
Linux Linux 6.8 -

II. Public POCs for CVE-2025-40171

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2025-40171

请登录查看更多情报信息。

Same Patch Batch · Linux · 2025-11-12 · 96 CVEs total

CVE-2025-40176 9.8 CRITICAL tls: wait for pending async decryptions if tls_strp_msg_hold fails
CVE-2025-40140 8.8 HIGH net: usb: Remove disruptive netif_wake_queue in rtl8150_set_multicast
CVE-2025-40133 8.1 HIGH mptcp: Use __sk_dst_get() and dst_dev_rcu() in mptcp_active_enable().
CVE-2025-40204 8.1 HIGH sctp: Fix MAC comparison to be constant-time
CVE-2025-40168 8.1 HIGH smc: Use __sk_dst_get() and dst_dev_rcu() in smc_clc_prfx_match().
CVE-2025-40158 8.1 HIGH ipv6: use RCU in ip6_output()
CVE-2025-40135 8.1 HIGH ipv6: use RCU in ip6_xmit()
CVE-2025-40186 8.1 HIGH tcp: Don't call reqsk_fastopen_remove() in tcp_conn_request().
CVE-2025-40141 8.0 HIGH Bluetooth: ISO: Fix possible UAF on iso_conn_free
CVE-2025-40167 7.8 HIGH ext4: detect invalid INLINE_DATA + EXTENTS flag combination
CVE-2025-40159 7.8 HIGH xsk: Harden userspace-supplied xdp_desc validation
CVE-2025-40166 7.8 HIGH drm/xe/guc: Check GuC running state before deregistering exec queue
CVE-2025-40165 7.8 HIGH media: nxp: imx8-isi: m2m: Fix streaming cleanup on release
CVE-2025-40151 7.8 HIGH LoongArch: BPF: No support of struct argument in trampoline programs
CVE-2025-40149 7.8 HIGH tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock().
CVE-2025-40172 7.8 HIGH accel/qaic: Treat remaining == 0 as error in find_and_map_user_pages()
CVE-2025-40169 7.8 HIGH bpf: Reject negative offsets for ALU ops
CVE-2025-40201 7.8 HIGH kernel/sys.c: fix the racy usage of task_lock(tsk->group_leader) in sys_prlimit64() paths
CVE-2025-40203 7.8 HIGH listmount: don't call path_put() under namespace semaphore
CVE-2025-40205 7.8 HIGH btrfs: avoid potential out-of-bounds in btrfs_encode_fh()

Showing top 20 of 96 CVEs. View all on vendor page &rarr; →

IV. Related Vulnerabilities

Same product: Linux
Same vendor: Linux

V. Comments for CVE-2025-40171

No comments yet

Leave a comment