CVE-2025-40171
Description
A flaw was found in the Linux kernel's nvmet-fc component, which handles Non-Volatile Memory Express (NVMe) over Fibre Channel. A local attacker with low privileges could exploit a resource management issue. This flaw occurs when multiple asynchronous commands are processed, leading to a leaked reference. This can result in a Denial of Service (DoS), making the system unavailable.
Statement
A moderate-severity denial of service flaw was found in the Linux kernel's nvmet-fc driver, which implements the NVMe over Fibre Channel target. When more than one asynchronous command is in flight from __nvmet_fc_send_ls_req, a tgtport reference is taken for each command, but only one put work item can be queued at a time, resulting in a leaked reference. A local attacker with low privileges could exploit this resource leak to cause a denial of service, making the system unavailable (Red Hat CVSS 5.5, CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H). Only availability is impacted; there is no effect on confidentiality or integrity. The upstream CVE record rates this issue Important (7.5) using a network attack vector with no privileges required, while Red Hat's assessment of the affected code path is a local vector requiring low privileges, which is reflected in the lower Moderate rating. Red Hat Enterprise Linux 6 and 7 (including the kernel-rt variant) are not affected because the vulnerable code is not present in those versions. The affected Red Hat Enterprise Linux 8, 9, and 10 streams and Red Hat In-Vehicle OS 1.1 have the fix deferred to a future update; given the moderate severity and local-only availability impact of this flaw, the residual risk of deferral is limited to a local denial of service on systems configured as NVMe over Fibre Channel targets.
Mitigation
To mitigate this issue, prevent the 'nvmet-fc' kernel module from loading if NVMe over Fibre Channel functionality is not required. Create a file named `/etc/modprobe.d/blacklist-nvmet-fc.conf` with the following content:
blacklist nvmet-fc
install nvmet-fc /bin/true
After creating the file, regenerate the initramfs and reboot the system for the changes to take effect. This may impact systems that rely on NVMe over Fibre Channel for storage operations. A system reboot is required for the changes to be fully applied.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 5.5 | N/A | 7.5 |
| Attack Vector | Local | N/A | Network |
| Attack Complexity | Low | N/A | Low |
| Privileges Required | Low | N/A | None |
| User Interaction | None | N/A | None |
| Scope | Unchanged | N/A | Unchanged |
| Confidentiality | None | N/A | None |
| Integrity Impact | None | N/A | None |
| Availability Impact | High | N/A | High |
Vector
Red Hat: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
cve.org: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
