---
id: CVE-2025-40171
title: >-
  kernel: Kernel: Denial of Service in nvmet-fc due to resource leak
  (CVE-2025-40171)
summary: >-
  A flaw was found in the Linux kernel's nvmet-fc component, which handles
  Non-Volatile Memory Express (NVMe) over Fibre Channel. A local attacker with
  low privileges could exploit a resource management issue. This flaw occurs
  when multiple …
severity: medium
cvss: 5.5
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'
cvssSource: vendor
cwe: CWE-772
vendor: Red Hat
product: Red Hat Enterprise Linux 9
affected:
  - enterprise_linux 10
  - enterprise_linux 8
  - enterprise_linux 9
published: '2025-11-12'
updated: '2026-10-16'
sourceUpdated: '2026-10-16T23:16:40+00:00'
source: CSAF
sourceUrl: 'https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-40171.json'
references:
  - url: >-
      https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-40171.json
  - url: 'https://access.redhat.com/security/cve/CVE-2025-40171'
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2414505'
  - url: 'https://www.cve.org/CVERecord?id=CVE-2025-40171'
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2025-40171'
  - url: >-
      https://lore.kernel.org/linux-cve-announce/2025111259-CVE-2025-40171-0cb5@gregkh/T
  - url: 'https://git.kernel.org/stable/c/11269c08013f4ee8b8f5edc6c56700acb34092d0'
  - url: 'https://git.kernel.org/stable/c/a28112cc55013cd8cbd5d36b5115a5b851151bd9'
  - url: 'https://git.kernel.org/stable/c/060ecc81240ef9d60d9485a3a5eb55a0d6e7a25c'
  - url: 'https://git.kernel.org/stable/c/7331925c247b03b7767b8cd93cfe1b7aa2377850'
  - url: 'https://git.kernel.org/stable/c/7a619f8c869117ffed08365b377f66b7e1d941b4'
  - url: 'https://git.kernel.org/stable/c/db5a5406fb7e5337a074385c7a3e53c77f2c1bd3'
tags:
  - csaf
  - vex
  - red-hat
  - cve.org
  - score-dispute
epss: 0.00473
epssPercentile: 0.4071
ssvc:
  exploitation: none
  automatable: 'yes'
  technicalImpact: partial
  timestamp: '2026-10-15T21:57:33.774431Z'
scores:
  vendor: 5.5
  cna: 7.5
ingestedAt: '2026-10-15T22:48:25.549Z'
---

## Overview

A flaw was found in the Linux kernel's nvmet-fc component, which handles Non-Volatile Memory Express (NVMe) over Fibre Channel. A local attacker with low privileges could exploit a resource management issue. This flaw occurs when multiple asynchronous commands are processed, leading to a leaked reference. This can result in a Denial of Service (DoS), making the system unavailable.

## Vendor advisories

- **Red Hat VEX** · Moderate · affected: Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9 · no fix planned: Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9 · updated 2026-10-16 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-40171.json)

**kernel: Kernel: Denial of Service in nvmet-fc due to resource leak** — rated Moderate by Red Hat. Released 2025-11-12, updated 2026-10-16.

Affected:

- Red Hat Enterprise Linux 10
- Red Hat Enterprise Linux 8
- Red Hat Enterprise Linux 9

No fix planned:

- Red Hat Enterprise Linux 10
- Red Hat Enterprise Linux 8
- Red Hat Enterprise Linux 9

Not affected:

- Red Hat Enterprise Linux 6
- Red Hat Enterprise Linux 7

## Remediation

Fix deferred

Workarounds / mitigations:

- To mitigate this issue, prevent the 'nvmet-fc' kernel module from loading if NVMe over Fibre Channel functionality is not required. Create a file named `/etc/modprobe.d/blacklist-nvmet-fc.conf` with the following content:

```
blacklist nvmet-fc
install nvmet-fc /bin/true
```

After creating the file, regenerate the initramfs and reboot the system for the changes to take effect. This may impact systems that rely on NVMe over Fibre Channel for storage operations. A system reboot is required for …