Linux nvme-fc: unlocked port_state check races remote-port teardown against reconnect

Impact

nvme_fc_create_association reads the local port state and bumps the remote port's active count without holding the lock that nvme_fc_unregister_remote_port takes, so a remote-port unregister racing a reconnect can operate on a port being torn down. The practical exposure is kernel-side memory corruption or a crash on the host during FC fabric events - link flaps, array maintenance, controller failover - which on a GPU node means losing the node mid-job rather than losing data to an attacker. There is no tenant-facing trigger in the record: the race is driven by storage-fabric timing, not by a request an unprivileged user can submit. Only hosts that actually mount NVMe over Fibre Channel are affected; nodes using NVMe/TCP, RDMA or local PCIe NVMe are not.

Who can reach it

No authenticated attack path is established. Reachable on hosts with the nvme-fc transport in use, through remote-port registration churn on the FC fabric; NVD's AV:A rating reflects adjacent-network scoring by the kernel CNA, not a demonstrated remote trigger.

What to do

Update to a stable kernel carrying the locking fix (backported across five stable branches - see the git.kernel.org commits) and reboot the affected storage-attached hosts, or reload the nvme-fc module if your workload tolerates dropping FC-attached namespaces. The upstream record names no fixed release tag, so match the backport to your branch. Hosts that do not use NVMe over Fibre Channel need no maintenance window for this.

References

Related entries

• CephFS kernel client (ceph.ko, MDS auth caps): In a multi-FS Ceph cluster the kernel client applies an MDS auth capCVE-2025-40362 · CephFS kernel client (ceph.ko, MDS auth caps)High
• libssh: failed key derivation returns success, leaving SSH sessions keyed with uninitialized memoryCVE-2025-5372 · libssh (ssh_kdf key derivation, builds against OpenSSL older than 3.0)High
• AMD Pensando ionic cloud driver for VMware ESXi (heap overflow): Second heap overflow in the ionic ESXi driverCVE-2025-62623 · AMD Pensando ionic cloud driver for VMware ESXi (heap overflow)High
• AMD Pensando ionic cloud driver for VMware ESXi (heap overflow): Heap-based buffer overflow in the ionic SmartNICCVE-2025-62624 · AMD Pensando ionic cloud driver for VMware ESXi (heap overflow)High
• Linux qla2xxx: abort-all path calls sp->done() without checking cmd_type, crashing in target modeCVE-2025-68818 · Linux kernel qla2xxx (FC HBA abort path, target mode)High
• Linux kernel (drivers/iommu): This is the substantive fix for stale IOMMU translations of the kernel address spaceCVE-2025-71202 · Linux kernel (drivers/iommu)High