The Linux kernel's nvmet-fc subsystem had a vulnerability where, during a forced shutdown of a port via the configfs interface, two functions—nvmet_port_subsys_drop_link() calling nvmet_port_del_ctrls() and nvmet_disable_port()—both scheduled deletion of all remaining associations. The implementation only checked if an association was about to be removed after scheduling the work item, allowing the same association deletion to be scheduled twice. Because the association list is an RCU list, direct locking and removal are not possible, so a terminating flag is used to prevent double scheduling. This could lead to use-after-free or double-free conditions. The vulnerability is tracked as CVE-2025-40343 and has been resolved in the Linux kernel.

The vulnerability could lead to critical impacts including complete compromise of confidentiality, integrity, and availability of the affected system due to potential double-free or use-after-free conditions in kernel memory management. This can cause system crashes or allow an attacker to execute arbitrary code with kernel privileges.

A fix has been implemented in the Linux kernel to address this vulnerability by properly using a terminating flag to prevent scheduling association deletion twice. Users should apply the official Linux kernel updates that include this fix. Patch status is not explicitly confirmed in the provided data; therefore, check the vendor or Linux kernel advisory for the current remediation guidance.