CVE-2025-40342 — Missing Synchronization in Linux
Severity
7.8HIGHOSV
OSV3.2
No vectorEPSS
0.1%
top 78.93%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
Timeline
PublishedDec 9
Latest updateApr 13
Description
In the Linux kernel, the following vulnerability has been resolved:
nvme-fc: use lock accessing port_state and rport state
nvme_fc_unregister_remote removes the remote port on a lport object at
any point in time when there is no active association. This races with
with the reconnect logic, because nvme_fc_create_association is not
taking a lock to check the port_state and atomically increase the
active count on the rport.
Affected Packages7 packages
▶CVEListV5linux/linuxe399441de9115cd472b8ace6c517708273ca7997 — de3d91af47bc015031e7721b100a29989f6498a5+7