CVE-2025-40261: 
Linux Kernel vulnerability analysis and mitigation

CVE-2025-40261 is a race condition vulnerability in the Linux kernel's NVMe-FC (Fibre Channel) driver that can cause list corruption and a kernel crash during controller deletion. The flaw exists because ->ioerr_work can be queued after cancel_work_sync() has already been called in nvme_fc_delete_ctrl(), leading to use-after-free conditions on the nvme_fc_ctrl object. It was published on December 4, 2025, and affects the Linux kernel, including Microsoft Azure Linux 3 kernel packages (azl3_kernel_6.6.112.1-2 and azl3_kernel_6.6.117.1-1). It carries a CVSS v3.1 base score of 6.6 (Medium) (Feedly).

The root cause is a race condition (CWE-362) in the nvme_fc_delete_ctrl() function of the Linux kernel's NVMe-FC driver. Specifically, nvme_fc_delete_assocation() waits for pending I/O to complete before returning, but an I/O error during this process can cause ->ioerr_work to be re-queued after cancel_work_sync() has already been invoked. This results in the ioerr_work workqueue item running against an already-freed nvme_fc_ctrl object, triggering a list_del corruption kernel BUG at lib/list_debug.c:52. The fix moves the cancel_work_sync() call to after nvme_fc_delete_association() completes, ensuring the work item cannot be re-queued before cancellation (Feedly).

Successful exploitation can cause a kernel panic/crash, resulting in a complete denial of service for the affected system. The vulnerability has high availability impact, with potential to crash systems running NVMe-FC storage configurations. There is also low confidentiality and integrity impact due to the memory corruption nature of the bug, though the primary risk is system instability and unplanned downtime for storage-dependent workloads (Feedly).

Exploitation requires local access with low privileges, as an attacker must be able to trigger NVMe-FC controller deletion or I/O error conditions on the affected system. There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time. The EPSS score is approximately 0.018% (0.000180), indicating very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog (Feedly).

• Logs: Kernel logs (dmesg or /var/log/kern.log) showing list_del corruption messages, specifically entries like ff2d24c8093f31f8->next is NULL and kernel BUG at lib/list_debug.c:52.
• Logs: Kernel oops/panic traces referencing __list_del_entry_valid_or_report.cold and workqueue context nvme-wq.
• Process: Unexpected system reboots or kernel panics on systems using NVMe-FC storage, particularly during controller deletion or storage failover events.
• Logs: Crash dump (kdump) artifacts referencing nvme_fc_delete_ctrl or nvme_fc_delete_association in the stack trace.

Apply the vendor-provided kernel patches that move cancel_work_sync() to execute after nvme_fc_delete_association() completes. Patches are available via the Linux kernel stable tree (commits 0a2c5495b6d1, 3f48cd7f35da, 33f64600a120, 48ae433c6cc6) and have been incorporated into downstream distributions including Ubuntu (USN-8096-1 through USN-8096-5, USN-8094-x, USN-8152-1), Debian (DLA-4436-1, DSA-6243-1, DLA-4561-1), SUSE, Oracle Linux, and Microsoft Azure Linux 3. As a workaround where patching is not immediately possible, limit local user access to NVMe-FC management operations and exercise caution when deleting NVMe-FC controllers or managing connections (Feedly, Ubuntu Advisory, Debian LTS).