Security readout for executives and security teams
Plain-English summary
A reference-counting flaw in Linux’s NVMe over Fibre Channel target code can leak resources when multiple asynchronous requests overlap. Repeated leakage may eventually exhaust resources and disrupt storage availability. General-purpose Linux systems are unlikely to be exposed unless they operate the affected NVMe-FC target functionality.
Executive priority
Prioritize storage infrastructure using Linux as an NVMe-FC target because failure could interrupt dependent services. Remediate promptly within the high-severity patch cycle, with faster handling for critical or broadly reachable storage fabrics. Systems not using nvmet-fc can be deprioritized after configuration evidence confirms non-exposure.
Technical view
The nvmet-fc path takes a target-port reference for each asynchronous request from __nvmet_fc_send_ls_req, but previously queued only one release work item. Concurrent operations can therefore leave references unreleased. The cited kernel changes associate release work with each nvmet_fc_ls_req_op. The supplied CVSS 3.1 score is 7.5, reflecting remote availability impact without confidentiality or integrity impact.
Likely exposure
Exposure is concentrated in Linux systems providing NVMe over Fibre Channel target services through nvmet-fc. Risk depends on whether that functionality is active and reachable through the relevant storage fabric. Ordinary hosts not operating this target path are unlikely to encounter the vulnerable behavior. The flattened version information is ambiguous, so kernel builds require commit-level or vendor confirmation.
Exploitation context
The bundle marks this CVE as absent from KEV and provides no evidence of active exploitation or a public exploit. The CVSS vector describes network reachability, low complexity, no privileges, and no user interaction, but the sources do not document attack mechanics or observed incidents. Treat deliberate exploitation as possible but unconfirmed.
Researcher notes
The failure is a per-command lifetime-management defect: multiple operations acquire references, while the old shared release mechanism may process only one. The source bundle lists stable fixes but does not preserve sufficiently clear version-range semantics for definitive branch mapping. Validate individual kernel packages through fix-commit ancestry or authoritative vendor backport documentation.
Mitigation direction
- Identify systems operating Linux NVMe over Fibre Channel target services.
- Apply a vendor-supported kernel containing the appropriate cited stable fix.
- Use commit-level verification when vendor kernels contain backported patches.
- Restrict access to the NVMe-FC target environment while remediation is pending.
Validation and detection
- Confirm whether nvmet-fc target functionality is active on each potentially affected host.
- Record running kernel builds and compare them with vendor vulnerability guidance.
- Check vendor backport records for the relevant cited stable commit.
- Monitor affected storage targets for resource growth, degradation, or availability failures.
- Retest concurrent operational workloads after patching to confirm stability.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2025-40171 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.5 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H3.93.6LinuxVulnerability scoring details
Base CVSS 3.1 score
7.5HighVector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/11269c08013f4ee8b8f5edc6c56700acb34092d0CVE reference, Linux
- https://git.kernel.org/stable/c/a28112cc55013cd8cbd5d36b5115a5b851151bd9CVE reference, Linux
- https://git.kernel.org/stable/c/060ecc81240ef9d60d9485a3a5eb55a0d6e7a25cCVE reference, Linux
- https://git.kernel.org/stable/c/7331925c247b03b7767b8cd93cfe1b7aa2377850CVE reference, Linux
- https://git.kernel.org/stable/c/7a619f8c869117ffed08365b377f66b7e1d941b4CVE reference, Linux
- https://git.kernel.org/stable/c/db5a5406fb7e5337a074385c7a3e53c77f2c1bd3CVE reference, Linux
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.