CVE-2025-40343: 
Linux Kernel vulnerability analysis and mitigation

CVE-2025-40343 is a use-after-free/double-scheduling vulnerability in the Linux kernel's nvmet-fc (NVMe over Fibre Channel target) module. The flaw occurs when forcefully shutting down a port via the configfs interface, where nvmet_port_subsys_drop_link() calls both nvmet_port_del_ctrls() and nvmet_disable_port(), each of which can independently schedule all remaining associations for deletion — potentially freeing resources and then scheduling the same work item again. It was published on December 9, 2025, and affects multiple stable Linux kernel branches. The CVSS v3.1 base score is 7.0 (High), reflecting a local attack vector with high complexity and low privileges required (Microsoft MSRC, ENISA EUVD).

The root cause is a race condition / improper resource management (CWE-415: Double Free or related use-after-free) in the nvmet-fc kernel module. When a port is shut down via configfs, two code paths — nvmet_port_del_ctrls() and nvmet_disable_port() — both iterate over the RCU-protected association list and schedule work items for association deletion. Because the association list uses RCU (Read-Copy-Update), it is not possible to atomically remove an entry under a lock before the second scheduling occurs. The fix introduces a terminating flag on each association so that the second scheduling attempt can detect that deletion is already in progress and skip re-queuing the work item (ENISA EUVD, Microsoft MSRC).

Successful exploitation could result in resource exhaustion, kernel memory corruption, or system instability due to double-freeing of association resources in the nvmet-fc subsystem. The CVSS scoring reflects high impact across confidentiality, integrity, and availability, meaning a successful exploit could theoretically allow an attacker to crash the system (denial of service) or potentially escalate privileges by corrupting kernel memory structures. The scope is limited to the local system, but systems acting as NVMe-oF Fibre Channel targets are particularly at risk (Microsoft MSRC, ENISA EUVD).

Patches have been released for multiple stable Linux kernel branches. Fixed versions include: 5.15.197, 6.1.159, 6.6.117, 6.17.8, and 6.18. Upstream kernel commits addressing the issue are available via the stable kernel git repository. Microsoft has also released a patch for the Azure Linux 3 kernel (azl3_kernel_6.6.112.1-2). Ubuntu security notices USN-8096-1, USN-8096-2, USN-8096-3, and USN-8096-5 address this vulnerability for Ubuntu users. Debian LTS users should refer to DLA-4436-1. Administrators should update to the latest patched kernel version for their distribution and restrict local system access to minimize exposure (Microsoft MSRC, Ubuntu USN-8096-1, Debian LTS).

The vulnerability received routine coverage from Linux security tracking services including Tenable (Nessus plugins 277836, 299303, 302765), Qualys, and Linux security news aggregators. Ubuntu and Debian issued formal security advisories addressing the flaw. No notable researcher commentary or significant social media discussion has been identified beyond standard vulnerability tracking (Ubuntu USN-8096-1, Debian LTS).