In the Linux kernel, the following vulnerability has been resolved:
nvmet-fc: move lsop put work to nvmetfclsreqop
It’s possible for more than one async command to be in flight from _nvmetfcsendls_req. For each command, a tgtport reference is taken.
In the current code, only one put work item is queued at a time, which results in a leaked reference.
To fix this, move the work item to the nvmetfclsreqop struct, which already tracks all resources related to the command.
[
{
"digest": {
"length": 509.0,
"function_hash": "246030230746969183343590568318557013506"
},
"target": {
"file": "drivers/nvme/target/fc.c",
"function": "__nvmet_fc_finish_ls_req"
},
"signature_type": "Function",
"id": "CVE-2025-40171-03243cd6",
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@a28112cc55013cd8cbd5d36b5115a5b851151bd9",
"deprecated": false
},
{
"digest": {
"length": 164.0,
"function_hash": "233706968698899956933965505541672339515"
},
"target": {
"file": "drivers/nvme/target/fc.c",
"function": "nvmet_fc_put_tgtport_work"
},
"signature_type": "Function",
"id": "CVE-2025-40171-0c38b69a",
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@11269c08013f4ee8b8f5edc6c56700acb34092d0",
"deprecated": false
},
{
"digest": {
"length": 509.0,
"function_hash": "246030230746969183343590568318557013506"
},
"target": {
"file": "drivers/nvme/target/fc.c",
"function": "__nvmet_fc_finish_ls_req"
},
"signature_type": "Function",
"id": "CVE-2025-40171-0f569526",
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@db5a5406fb7e5337a074385c7a3e53c77f2c1bd3",
"deprecated": false
},
{
"digest": {
"line_hashes": [
"180035669653172986647170383926454687269",
"216183223803082227049232262857536956678",
"219307188535559000032245857209637662560",
"156861776721598375071038918650051653608",
"242146493951468640085116907226458064052",
"187022071401317257288196473112215431561",
"332890757786751012617876662490521186776",
"322283132870316043748949728235475688142",
"140247471282094372777377045427615281558",
"87159003644498416195830936548539135565",
"152931542545010867413323093157912483110",
"160422437463596368408872820794409256363",
"298953797594100606473403424603878727503",
"288641240953043491217524925037874118099",
"124600346800583389333936134827821124605",
"188297989644033090263977062219079489648",
"262771006022121826720198619763497788285",
"157477198850352836169409143408801742422",
"241160716390553521521785216648457961632",
"119047538542473997956141188211476007655",
"68085362487076475425602528487243233401",
"118954572777522259480702584593102085149",
"58418370414414425965476683561024105327",
"128847646935661965106975068510008010781",
"143491077242058816435979736434082994990",
"273518996202919250042148684910784314712",
"316514691736344141313277059590708515054",
"155360288754802552857087717303361193583",
"211344783659999686323550440245488237592",
"201788722650869057334168329872956861405",
"165938130483889148963728590343708196505",
"256816743282497696291608523666682098347"
],
"threshold": 0.9
},
"target": {
"file": "drivers/nvme/target/fc.c"
},
"signature_type": "Line",
"id": "CVE-2025-40171-0ffc75a3",
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@060ecc81240ef9d60d9485a3a5eb55a0d6e7a25c",
"deprecated": false
},
{
"digest": {
"line_hashes": [
"180035669653172986647170383926454687269",
"216183223803082227049232262857536956678",
"219307188535559000032245857209637662560",
"156861776721598375071038918650051653608",
"242146493951468640085116907226458064052",
"187022071401317257288196473112215431561",
"332890757786751012617876662490521186776",
"322283132870316043748949728235475688142",
"140247471282094372777377045427615281558",
"87159003644498416195830936548539135565",
"152931542545010867413323093157912483110",
"160422437463596368408872820794409256363",
"298953797594100606473403424603878727503",
"288641240953043491217524925037874118099",
"124600346800583389333936134827821124605",
"188297989644033090263977062219079489648",
"262771006022121826720198619763497788285",
"157477198850352836169409143408801742422",
"241160716390553521521785216648457961632",
"119047538542473997956141188211476007655",
"68085362487076475425602528487243233401",
"118954572777522259480702584593102085149",
"58418370414414425965476683561024105327",
"128847646935661965106975068510008010781",
"143491077242058816435979736434082994990",
"273518996202919250042148684910784314712",
"316514691736344141313277059590708515054",
"155360288754802552857087717303361193583",
"211344783659999686323550440245488237592",
"201788722650869057334168329872956861405",
"165938130483889148963728590343708196505",
"256816743282497696291608523666682098347"
],
"threshold": 0.9
},
"target": {
"file": "drivers/nvme/target/fc.c"
},
"signature_type": "Line",
"id": "CVE-2025-40171-1258cde0",
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@a28112cc55013cd8cbd5d36b5115a5b851151bd9",
"deprecated": false
},
{
"digest": {
"length": 1255.0,
"function_hash": "268667496650545797761102477837985868919"
},
"target": {
"file": "drivers/nvme/target/fc.c",
"function": "__nvmet_fc_send_ls_req"
},
"signature_type": "Function",
"id": "CVE-2025-40171-20e699d8",
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@a28112cc55013cd8cbd5d36b5115a5b851151bd9",
"deprecated": false
},
{
"digest": {
"length": 194.0,
"function_hash": "119047906299356920955745625098424989031"
},
"target": {
"file": "drivers/nvme/target/fc.c",
"function": "nvmet_fc_disconnect_assoc_done"
},
"signature_type": "Function",
"id": "CVE-2025-40171-216d0d98",
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@060ecc81240ef9d60d9485a3a5eb55a0d6e7a25c",
"deprecated": false
},
{
"digest": {
"length": 509.0,
"function_hash": "246030230746969183343590568318557013506"
},
"target": {
"file": "drivers/nvme/target/fc.c",
"function": "__nvmet_fc_finish_ls_req"
},
"signature_type": "Function",
"id": "CVE-2025-40171-328373f8",
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@7a619f8c869117ffed08365b377f66b7e1d941b4",
"deprecated": false
},
{
"digest": {
"length": 164.0,
"function_hash": "233706968698899956933965505541672339515"
},
"target": {
"file": "drivers/nvme/target/fc.c",
"function": "nvmet_fc_put_tgtport_work"
},
"signature_type": "Function",
"id": "CVE-2025-40171-33dc2d27",
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@db5a5406fb7e5337a074385c7a3e53c77f2c1bd3",
"deprecated": false
},
{
"digest": {
"length": 1255.0,
"function_hash": "268667496650545797761102477837985868919"
},
"target": {
"file": "drivers/nvme/target/fc.c",
"function": "__nvmet_fc_send_ls_req"
},
"signature_type": "Function",
"id": "CVE-2025-40171-3dd3c233",
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@db5a5406fb7e5337a074385c7a3e53c77f2c1bd3",
"deprecated": false
},
{
"digest": {
"length": 194.0,
"function_hash": "119047906299356920955745625098424989031"
},
"target": {
"file": "drivers/nvme/target/fc.c",
"function": "nvmet_fc_disconnect_assoc_done"
},
"signature_type": "Function",
"id": "CVE-2025-40171-5fb4479a",
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@7331925c247b03b7767b8cd93cfe1b7aa2377850",
"deprecated": false
},
{
"digest": {
"length": 194.0,
"function_hash": "119047906299356920955745625098424989031"
},
"target": {
"file": "drivers/nvme/target/fc.c",
"function": "nvmet_fc_disconnect_assoc_done"
},
"signature_type": "Function",
"id": "CVE-2025-40171-78ead3f3",
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@7a619f8c869117ffed08365b377f66b7e1d941b4",
"deprecated": false
},
{
"digest": {
"length": 164.0,
"function_hash": "233706968698899956933965505541672339515"
},
"target": {
"file": "drivers/nvme/target/fc.c",
"function": "nvmet_fc_put_tgtport_work"
},
"signature_type": "Function",
"id": "CVE-2025-40171-7f9de9d2",
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@7a619f8c869117ffed08365b377f66b7e1d941b4",
"deprecated": false
},
{
"digest": {
"line_hashes": [
"180035669653172986647170383926454687269",
"216183223803082227049232262857536956678",
"219307188535559000032245857209637662560",
"156861776721598375071038918650051653608",
"242146493951468640085116907226458064052",
"187022071401317257288196473112215431561",
"332890757786751012617876662490521186776",
"322283132870316043748949728235475688142",
"140247471282094372777377045427615281558",
"87159003644498416195830936548539135565",
"152931542545010867413323093157912483110",
"160422437463596368408872820794409256363",
"298953797594100606473403424603878727503",
"288641240953043491217524925037874118099",
"124600346800583389333936134827821124605",
"188297989644033090263977062219079489648",
"262771006022121826720198619763497788285",
"157477198850352836169409143408801742422",
"241160716390553521521785216648457961632",
"119047538542473997956141188211476007655",
"68085362487076475425602528487243233401",
"118954572777522259480702584593102085149",
"58418370414414425965476683561024105327",
"128847646935661965106975068510008010781",
"143491077242058816435979736434082994990",
"273518996202919250042148684910784314712",
"316514691736344141313277059590708515054",
"155360288754802552857087717303361193583",
"211344783659999686323550440245488237592",
"201788722650869057334168329872956861405",
"165938130483889148963728590343708196505",
"256816743282497696291608523666682098347"
],
"threshold": 0.9
},
"target": {
"file": "drivers/nvme/target/fc.c"
},
"signature_type": "Line",
"id": "CVE-2025-40171-865bd35b",
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@11269c08013f4ee8b8f5edc6c56700acb34092d0",
"deprecated": false
},
{
"digest": {
"line_hashes": [
"180035669653172986647170383926454687269",
"216183223803082227049232262857536956678",
"219307188535559000032245857209637662560",
"156861776721598375071038918650051653608",
"242146493951468640085116907226458064052",
"187022071401317257288196473112215431561",
"332890757786751012617876662490521186776",
"322283132870316043748949728235475688142",
"140247471282094372777377045427615281558",
"87159003644498416195830936548539135565",
"152931542545010867413323093157912483110",
"160422437463596368408872820794409256363",
"298953797594100606473403424603878727503",
"288641240953043491217524925037874118099",
"124600346800583389333936134827821124605",
"188297989644033090263977062219079489648",
"262771006022121826720198619763497788285",
"157477198850352836169409143408801742422",
"241160716390553521521785216648457961632",
"119047538542473997956141188211476007655",
"68085362487076475425602528487243233401",
"118954572777522259480702584593102085149",
"58418370414414425965476683561024105327",
"128847646935661965106975068510008010781",
"143491077242058816435979736434082994990",
"273518996202919250042148684910784314712",
"316514691736344141313277059590708515054",
"155360288754802552857087717303361193583",
"211344783659999686323550440245488237592",
"201788722650869057334168329872956861405",
"165938130483889148963728590343708196505",
"256816743282497696291608523666682098347"
],
"threshold": 0.9
},
"target": {
"file": "drivers/nvme/target/fc.c"
},
"signature_type": "Line",
"id": "CVE-2025-40171-8cd51c36",
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@db5a5406fb7e5337a074385c7a3e53c77f2c1bd3",
"deprecated": false
},
{
"digest": {
"length": 194.0,
"function_hash": "119047906299356920955745625098424989031"
},
"target": {
"file": "drivers/nvme/target/fc.c",
"function": "nvmet_fc_disconnect_assoc_done"
},
"signature_type": "Function",
"id": "CVE-2025-40171-9361fa3a",
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@a28112cc55013cd8cbd5d36b5115a5b851151bd9",
"deprecated": false
},
{
"digest": {
"length": 509.0,
"function_hash": "246030230746969183343590568318557013506"
},
"target": {
"file": "drivers/nvme/target/fc.c",
"function": "__nvmet_fc_finish_ls_req"
},
"signature_type": "Function",
"id": "CVE-2025-40171-a8faebaa",
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@060ecc81240ef9d60d9485a3a5eb55a0d6e7a25c",
"deprecated": false
},
{
"digest": {
"length": 164.0,
"function_hash": "233706968698899956933965505541672339515"
},
"target": {
"file": "drivers/nvme/target/fc.c",
"function": "nvmet_fc_put_tgtport_work"
},
"signature_type": "Function",
"id": "CVE-2025-40171-ab333ea1",
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@7331925c247b03b7767b8cd93cfe1b7aa2377850",
"deprecated": false
},
{
"digest": {
"line_hashes": [
"180035669653172986647170383926454687269",
"216183223803082227049232262857536956678",
"219307188535559000032245857209637662560",
"156861776721598375071038918650051653608",
"242146493951468640085116907226458064052",
"187022071401317257288196473112215431561",
"332890757786751012617876662490521186776",
"322283132870316043748949728235475688142",
"140247471282094372777377045427615281558",
"87159003644498416195830936548539135565",
"152931542545010867413323093157912483110",
"160422437463596368408872820794409256363",
"298953797594100606473403424603878727503",
"288641240953043491217524925037874118099",
"124600346800583389333936134827821124605",
"188297989644033090263977062219079489648",
"262771006022121826720198619763497788285",
"157477198850352836169409143408801742422",
"241160716390553521521785216648457961632",
"119047538542473997956141188211476007655",
"68085362487076475425602528487243233401",
"118954572777522259480702584593102085149",
"58418370414414425965476683561024105327",
"128847646935661965106975068510008010781",
"143491077242058816435979736434082994990",
"273518996202919250042148684910784314712",
"316514691736344141313277059590708515054",
"155360288754802552857087717303361193583",
"211344783659999686323550440245488237592",
"201788722650869057334168329872956861405",
"165938130483889148963728590343708196505",
"256816743282497696291608523666682098347"
],
"threshold": 0.9
},
"target": {
"file": "drivers/nvme/target/fc.c"
},
"signature_type": "Line",
"id": "CVE-2025-40171-b1506b7a",
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@7331925c247b03b7767b8cd93cfe1b7aa2377850",
"deprecated": false
},
{
"digest": {
"length": 164.0,
"function_hash": "233706968698899956933965505541672339515"
},
"target": {
"file": "drivers/nvme/target/fc.c",
"function": "nvmet_fc_put_tgtport_work"
},
"signature_type": "Function",
"id": "CVE-2025-40171-b94b92f7",
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@a28112cc55013cd8cbd5d36b5115a5b851151bd9",
"deprecated": false
},
{
"digest": {
"length": 509.0,
"function_hash": "246030230746969183343590568318557013506"
},
"target": {
"file": "drivers/nvme/target/fc.c",
"function": "__nvmet_fc_finish_ls_req"
},
"signature_type": "Function",
"id": "CVE-2025-40171-bb01fa15",
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@11269c08013f4ee8b8f5edc6c56700acb34092d0",
"deprecated": false
},
{
"digest": {
"length": 1255.0,
"function_hash": "268667496650545797761102477837985868919"
},
"target": {
"file": "drivers/nvme/target/fc.c",
"function": "__nvmet_fc_send_ls_req"
},
"signature_type": "Function",
"id": "CVE-2025-40171-be07c06f",
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@7a619f8c869117ffed08365b377f66b7e1d941b4",
"deprecated": false
},
{
"digest": {
"length": 509.0,
"function_hash": "246030230746969183343590568318557013506"
},
"target": {
"file": "drivers/nvme/target/fc.c",
"function": "__nvmet_fc_finish_ls_req"
},
"signature_type": "Function",
"id": "CVE-2025-40171-c4977a87",
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@7331925c247b03b7767b8cd93cfe1b7aa2377850",
"deprecated": false
},
{
"digest": {
"length": 164.0,
"function_hash": "233706968698899956933965505541672339515"
},
"target": {
"file": "drivers/nvme/target/fc.c",
"function": "nvmet_fc_put_tgtport_work"
},
"signature_type": "Function",
"id": "CVE-2025-40171-ca3f666a",
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@060ecc81240ef9d60d9485a3a5eb55a0d6e7a25c",
"deprecated": false
},
{
"digest": {
"length": 1255.0,
"function_hash": "268667496650545797761102477837985868919"
},
"target": {
"file": "drivers/nvme/target/fc.c",
"function": "__nvmet_fc_send_ls_req"
},
"signature_type": "Function",
"id": "CVE-2025-40171-cab83e16",
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@060ecc81240ef9d60d9485a3a5eb55a0d6e7a25c",
"deprecated": false
},
{
"digest": {
"length": 1255.0,
"function_hash": "268667496650545797761102477837985868919"
},
"target": {
"file": "drivers/nvme/target/fc.c",
"function": "__nvmet_fc_send_ls_req"
},
"signature_type": "Function",
"id": "CVE-2025-40171-cd2b659a",
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@11269c08013f4ee8b8f5edc6c56700acb34092d0",
"deprecated": false
},
{
"digest": {
"length": 194.0,
"function_hash": "119047906299356920955745625098424989031"
},
"target": {
"file": "drivers/nvme/target/fc.c",
"function": "nvmet_fc_disconnect_assoc_done"
},
"signature_type": "Function",
"id": "CVE-2025-40171-d285aa24",
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@11269c08013f4ee8b8f5edc6c56700acb34092d0",
"deprecated": false
},
{
"digest": {
"length": 194.0,
"function_hash": "119047906299356920955745625098424989031"
},
"target": {
"file": "drivers/nvme/target/fc.c",
"function": "nvmet_fc_disconnect_assoc_done"
},
"signature_type": "Function",
"id": "CVE-2025-40171-d637fbfc",
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@db5a5406fb7e5337a074385c7a3e53c77f2c1bd3",
"deprecated": false
},
{
"digest": {
"line_hashes": [
"180035669653172986647170383926454687269",
"216183223803082227049232262857536956678",
"219307188535559000032245857209637662560",
"156861776721598375071038918650051653608",
"242146493951468640085116907226458064052",
"187022071401317257288196473112215431561",
"332890757786751012617876662490521186776",
"322283132870316043748949728235475688142",
"140247471282094372777377045427615281558",
"87159003644498416195830936548539135565",
"152931542545010867413323093157912483110",
"160422437463596368408872820794409256363",
"298953797594100606473403424603878727503",
"288641240953043491217524925037874118099",
"124600346800583389333936134827821124605",
"188297989644033090263977062219079489648",
"262771006022121826720198619763497788285",
"157477198850352836169409143408801742422",
"241160716390553521521785216648457961632",
"119047538542473997956141188211476007655",
"68085362487076475425602528487243233401",
"118954572777522259480702584593102085149",
"58418370414414425965476683561024105327",
"128847646935661965106975068510008010781",
"143491077242058816435979736434082994990",
"273518996202919250042148684910784314712",
"316514691736344141313277059590708515054",
"155360288754802552857087717303361193583",
"211344783659999686323550440245488237592",
"201788722650869057334168329872956861405",
"165938130483889148963728590343708196505",
"256816743282497696291608523666682098347"
],
"threshold": 0.9
},
"target": {
"file": "drivers/nvme/target/fc.c"
},
"signature_type": "Line",
"id": "CVE-2025-40171-d64af94e",
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@7a619f8c869117ffed08365b377f66b7e1d941b4",
"deprecated": false
},
{
"digest": {
"length": 1255.0,
"function_hash": "268667496650545797761102477837985868919"
},
"target": {
"file": "drivers/nvme/target/fc.c",
"function": "__nvmet_fc_send_ls_req"
},
"signature_type": "Function",
"id": "CVE-2025-40171-ee4ed740",
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@7331925c247b03b7767b8cd93cfe1b7aa2377850",
"deprecated": false
}
]