CVE-2025-40171
High
Description
In the Linux kernel, the following vulnerability has been resolved: nvmet-fc: move lsop put work to nvmet_fc_ls_req_op It’s possible for more than one async command to be in flight from __nvmet_fc_send_ls_req. For each command, a tgtport reference is taken. In the current code, only one put work item is queued at a time, which results in a leaked reference. To fix this, move the work item to the nvmet_fc_ls_req_op struct, which already tracks all resources related to the command.
SeverityHigh
CVSS7.5
Exploit probability—
Product
Linux
PublishedNov 12, 2025
First seenNov 12, 2025
How to fix
Update
- Linux Linux11269c08013f4ee8b8f5edc6c56700acb34092d0, a28112cc55013cd8cbd5d36b5115a5b851151bd9, 060ecc81240ef9d60d9485a3a5eb55a0d6e7a25c, 7331925c247b03b7767b8cd93cfe1b7aa2377850, 7a619f8c869117ffed08365b377f66b7e1d941b4, db5a5406fb7e5337a074385c7a3e53c77f2c1bd3, 5.15.195, 6.1.156, 6.6.112, 6.8 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| Linux Linux | 5e0bc09a52b6169ce90f7ac6e195791adb16cec4 ≤ v < 11269c08013f4ee8b8f5edc6c56700acb34092d0, 9e6987f8937a7bd7516aa52f25cb7e12c0c92ee8 ≤ v < a28112cc55013cd8cbd5d36b5115a5b851151bd9, eaf0971fdabf2a93c1429dc6bedf3bbe85dffa30 ≤ v < 060ecc81240ef9d60d9485a3a5eb55a0d6e7a25c, 710c69dbaccdac312e32931abcb8499c1525d397 ≤ v < 7331925c247b03b7767b8cd93cfe1b7aa2377850, 710c69dbaccdac312e32931abcb8499c1525d397 ≤ v < 7a619f8c869117ffed08365b377f66b7e1d941b4, 710c69dbaccdac312e32931abcb8499c1525d397 ≤ v < db5a5406fb7e5337a074385c7a3e53c77f2c1bd3, 1d86f79287206deec36d63b89c741cf542b6cadd, 5.15.150 ≤ v < 5.15.195, 6.1.80 ≤ v < 6.1.156, 6.6.19 ≤ v < 6.6.112, 6.7.7 ≤ v < 6.8, 6.8 | 11269c08013f4ee8b8f5edc6c56700acb34092d0, a28112cc55013cd8cbd5d36b5115a5b851151bd9, 060ecc81240ef9d60d9485a3a5eb55a0d6e7a25c, 7331925c247b03b7767b8cd93cfe1b7aa2377850, 7a619f8c869117ffed08365b377f66b7e1d941b4, db5a5406fb7e5337a074385c7a3e53c77f2c1bd3, 5.15.195, 6.1.156, 6.6.112, 6.8 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.