CVE-2025-40171: 
Linux Kernel vulnerability analysis and mitigation

CVE-2025-40171 is a vulnerability in the Linux kernel's nvmet-fc subsystem, discovered and disclosed on November 12, 2025. The vulnerability affects the way async commands are handled in __nvmet_fc_send_ls_req, specifically related to tgtport reference management (NVD).

The vulnerability occurs when multiple async commands are in flight from __nvmet_fc_send_ls_req. For each command, a tgtport reference is taken, but the current implementation only queues one put work item at a time. This design flaw results in a leaked reference. The issue exists in various Linux kernel versions, particularly affecting systems running specific kernel versions in Ubuntu distributions (Ubuntu).

The vulnerability leads to resource leakage in the Linux kernel's nvmet-fc subsystem, which could potentially affect system stability and performance over time. Multiple Ubuntu distributions including 22.04 LTS jammy and 20.04 LTS focal have been identified as vulnerable to this issue (Ubuntu).

A fix has been developed that moves the work item to the nvmet_fc_ls_req_op struct, which already tracks all resources related to the command. This solution ensures proper resource management for multiple async commands (NVD).