CVE-2025-40261

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 6.12.0

Description The Linux kernel contains a flaw within the nvme-fc subsystem. Specifically, the issue arises from improper handling of work queues during the deletion of an NVMe-FC controller association. The nvme fc delete association() function waits for pending I/O operations to complete before returning. However, an error condition can cause the ioerr work to be queued after cancel work sync() has already been called. This can lead to a kernel bug, potentially resulting in a list deletion corruption and ultimately an invalid opcode error.

Recommendations Versions prior to 6.12.0 should be updated to version 6.12.0 or later.