CVE-2025-40171

Отчет

A moderate-severity denial of service flaw was found in the Linux kernel's nvmet-fc driver, which implements the NVMe over Fibre Channel target. When more than one asynchronous command is in flight from __nvmet_fc_send_ls_req, a tgtport reference is taken for each command, but only one put work item can be queued at a time, resulting in a leaked reference. A local attacker with low privileges could exploit this resource leak to cause a denial of service, making the system unavailable (Red Hat CVSS 5.5, CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H). Only availability is impacted; there is no effect on confidentiality or integrity. The upstream CVE record rates this issue Important (7.5) using a network attack vector with no privileges required, while Red Hat's assessment of the affected code path is a local vector requiring low privileges, which is reflected in the lower Moderate rating. Red Hat Enterprise Linux 6 and 7 (including the kernel-rt variant) are not affected because the vulnerable code is not present in those versions. The affected Red Hat Enterprise Linux 8, 9, and 10 streams and Red Hat In-Vehicle OS 1.1 have the fix deferred to a future update; given the moderate severity and local-only availability impact of this flaw, the residual risk of deferral is limited to a local denial of service on systems configured as NVMe over Fibre Channel targets.

Меры по смягчению последствий

To mitigate this issue, prevent the 'nvmet-fc' kernel module from loading if NVMe over Fibre Channel functionality is not required. Create a file named /etc/modprobe.d/blacklist-nvmet-fc.conf with the following content:

After creating the file, regenerate the initramfs and reboot the system for the changes to take effect. This may impact systems that rely on NVMe over Fibre Channel for storage operations. A system reboot is required for the changes to be fully applied.