CVE-2025-40261

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

nvme: nvme-fc: Ensure ->ioerr_work is cancelled in nvme_fc_delete_ctrl()

nvme_fc_delete_assocation() waits for pending I/O to complete before

returning, and an error can cause ->ioerr_work to be queued after

cancel_work_sync() had been called. Move the call to cancel_work_sync() to

be after nvme_fc_delete_association() to ensure ->ioerr_work is not running

when the nvme_fc_ctrl object is freed. Otherwise the following can occur:

[ 1135.911754] list_del corruption, ff2d24c8093f31f8->next is NULL

[ 1135.917705] ------------[ cut here ]------------

[ 1135.922336] kernel BUG at lib/list_debug.c:52!

[ 1135.926784] Oops: invalid opcode: 0000 [#1] SMP NOPTI

[ 1135.931851] CPU: 48 UID: 0 PID: 726 Comm: kworker/u449:23 Kdump: loaded Not tainted 6.12.0 #1 PREEMPT(voluntary)

[ 1135.943490] Hardware name: Dell Inc. PowerEdge R660/0HGTK9, BIOS 2.5.4 01/16/2025

[ 1135.950969] Workqueue: 0x0 (nvme-wq)

[ 1135.954673] RIP: 0010:_

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References