Linux kernel nvmet-fc: association deletion can be scheduled twice on forced port shutdown

Impact

Dropping an NVMe-over-Fibre-Channel target port through configfs runs both nvmet_port_del_ctrls() and nvmet_disable_port(), and each schedules the remaining associations for deletion. The existing guard checked the removal flag only after the work item was queued, so one work item can free the association's resources and the same association can be queued for deletion again - a double free of target-side state. This only matters on hosts acting as NVMe-oF FC targets, which in a GPU datacenter means storage servers exporting NVMe namespaces rather than the compute nodes; the trigger is an administrative port teardown, so despite the AV:N score in NVD the realistic path is local root performing a shutdown, not a remote initiator.

Who can reach it

Local, privileged - requires the ability to drop a target port via the configfs interface on an nvmet-fc target host. Not reachable by a tenant workload or a remote NVMe initiator per the commit description.

What to do

Take the stable kernel commits that add the terminating flag to the association, then drain and reboot each NVMe-oF FC target host onto the patched kernel. Interim mitigation is procedural only: avoid forced configfs port drops on affected hosts. Nodes not running nvmet-fc are unaffected.

References

Related entries

• Linux kernel mlx5_core RX datapath (striding RQ + XDP multi-buffer): The mlx5 driver assumed an XDP program couldCVE-2025-40350 · Linux kernel mlx5_core RX datapath (striding RQ + XDP multi-buffer)Critical
• Xen: synthetic timer delivery assumes the SIM page is mapped, letting a guest crash the hostCVE-2025-58142 · Xen viridian enlightenments (SIM page, synthetic timer message delivery)Critical
• Xen: race in viridian reference TSC page mapping frees a page still live in the guest p2mCVE-2025-58143 · Xen viridian enlightenments (reference TSC page mapping race, p2m)Critical
• Linux kernel libceph: unchecked length from the wire allows out-of-bounds writes in cephx authCVE-2025-68284 · Linux kernel libceph (handle_auth_session_key length validation)Critical
• Linux kernel libceph: use-after-free racing a monmap or osdmap update during CephFS mountCVE-2025-68285 · Linux kernel libceph (have_mon_and_osd_map monmap/osdmap locking)Critical
• Linux kernel crypto: AEAD algorithms using cra_reqsize get an uninitialized reqsize, corrupting memoryCVE-2025-68726 · Linux kernel crypto AEAD framework (request size initialization)Critical