PT-2025-49091 · Linux+3 · Linux Kernel+3
Published
2025-11-10
·
Updated
2026-05-22
·
CVE-2025-40261
CVSS v2.0
5.7
Medium
| Vector | AV:L/AC:L/Au:S/C:P/I:P/A:C |
Name of the Vulnerable Software and Affected Versions
Linux kernel versions prior to 6.12.0
Description
The Linux kernel contains a flaw within the nvme-fc subsystem. Specifically, the issue arises from improper handling of work queues during the deletion of an NVMe-FC controller association. The
nvme fc delete association() function waits for pending I/O operations to complete before returning. However, an error condition can cause the ioerr work to be queued after cancel work sync() has already been called. This can lead to a kernel bug, potentially resulting in a list deletion corruption and ultimately an invalid opcode error.Recommendations
Versions prior to 6.12.0 should be updated to version 6.12.0 or later.
Exploit
Fix
Multiple Releases of Same Resource or Handle
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Debian
Linuxmint
Linux Kernel
Ubuntu