CVE-2025-40343

Vulnerability

CVE-2025-40343 is a use-after-free vulnerability in the Linux kernel's NVMe over Fabrics target (nvmet-fc) driver. The bug occurs during forceful shutdown of a port via the configfs interface: nvmet_port_subsys_drop_link() calls both nvmet_port_del_ctrls() and nvmet_disable_port(), each of which independently schedules deletion of all remaining associations [1]. The code only checks if an association is about to be removed after the work item has already been scheduled, allowing the same work item to be queued twice.

Exploitation

An attacker with local access and the ability to manage NVMe over Fabrics associations could trigger this double-scheduling by initiating a port shutdown. No special privileges beyond configfs manipulation are required [2]. The race window is narrow but deterministic in the presence of concurrent deletion operations.

Impact

When the same association deletion work runs twice, it can free resources already freed by the first run, leading to a use-after-free condition. This can crash the kernel (denial of service) or potentially allow local privilege escalation [3].

Mitigation

The fix, introduced in kernel commits [1], [2], [3], and [4], adds a terminating flag to the association structure. This flag is set before scheduling the deletion work item, and subsequent attempts to schedule it are blocked, preventing the double-scheduling race condition.