CVE-2025-40342: 
Linux Kernel vulnerability analysis and mitigation

CVE-2025-40342 is a race condition vulnerability in the Linux kernel's NVMe-FC (NVMe over Fibre Channel) subsystem, specifically in the remote port registration and association process. The flaw exists because nvme_fc_unregister_remote can remove a remote port on a local port (lport) object at any time when no active association exists, racing with the reconnect logic in nvme_fc_create_association, which does not take a lock before checking port_state or atomically incrementing the active count on the remote port (rport). It was published on December 9, 2025, and affects the Linux kernel across multiple stable branches. The CVSS v3.1 base score is 7.0 (High) (Microsoft MSRC, ENISA EUVD).

The root cause is a classic time-of-check to time-of-use (TOCTOU) race condition (CWE-362) in the Linux kernel's drivers/nvme/host/fc.c. When nvme_fc_create_association checks the port_state of an rport and attempts to increment its active reference count, it does so without holding the appropriate lock, allowing a concurrent call to nvme_fc_unregister_remote to remove the rport between the check and the increment. This can result in a use-after-free or null pointer dereference condition. The attack vector is local, requires low privileges, and has high attack complexity due to the need to trigger the specific race window (Microsoft MSRC, ENISA EUVD).

Successful exploitation of this race condition could result in high confidentiality, integrity, and availability impacts on the affected system. An attacker with local low-privilege access who wins the race could cause kernel memory corruption (use-after-free), potentially leading to system instability, kernel panic, or unauthorized code execution in kernel context. The scope is limited to the affected host, but kernel-level compromise could enable privilege escalation and full system takeover (Microsoft MSRC, ENISA EUVD).

There is no public proof-of-concept exploit available, and no evidence of in-the-wild exploitation has been observed. The EPSS score is approximately 0.024% (very low probability of exploitation in the near term). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The high attack complexity — requiring precise timing to trigger the race condition — significantly reduces practical exploitability (Microsoft MSRC, ENISA EUVD).

Patches have been backported to multiple stable Linux kernel versions. Administrators should update to the following fixed versions or later: 5.10.247, 5.15.197, 6.1.159, 6.6.117, 6.12.58, or 6.17.8/6.18. Debian LTS users should apply the linux-6.1 DLA-4436-1 update, and Ubuntu users should apply USN-8096-1, USN-8096-2, USN-8096-3, or USN-8096-5 as applicable. As a temporary workaround, disabling NVMe-FC on systems where it is not required can eliminate the attack surface (ENISA EUVD, Ubuntu USN-8096-1, Debian LTS).