CVE-2025-40171: Linux

High severity, CVSS 7.5. EPSS: 0.4% chance of exploitation in the next 30 days.

In the Linux kernel, the following vulnerability has been resolved: nvmet-fc: move lsop put work to nvmet_fc_ls_req_op It’s possible for more than one async command to be in flight from __nvmet_fc_send_ls_req. For each command, a tgtport reference is taken. In the current code, only one put work item is queued at a time, which results in a leaked reference. To fix this, move the work item to the nvmet_fc_ls_req_op struct, which already tracks all resources related to the command.

Affected products

• Linux Linux: from 5.15.150, before 5.15.195 (fixed in 5.15.195); from 6.1.80, before 6.1.156 (fixed in 6.1.156); from 6.6.19, before 6.6.112 (fixed in 6.6.112); from 6.7.7, before 6.8 (fixed in 6.8); from 6.8, before 6.12.53 (fixed in 6.12.53); from 6.13, before 6.17.3 (fixed in 6.17.3)

Published 2025-11-12. Last modified 2026-07-30.