01 Record

CVE-2025-40171

nvmet-fc: move lsop put work to nvmet_fc_ls_req_op

HighPUBLISHEDCNA: Linux

CNA base score7.5 CVSS v3.xCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

View raw JSON

02 Description

nvmet-fc: move lsop put work to nvmet_fc_ls_req_op

03 Exploitation and scoring

Exploitation

Assessed, none found. CISA's assessment recorded neither public exploit code nor evidence of exploitation when it was made.

SSVC decision

ExploitationnoneCISA recorded no public exploit code and no evidence of exploitation.
AutomatableyesAn attacker can reliably automate reconnaissance through exploitation, so this scales.
Technical ImpactpartialSuccessful exploitation gives limited control of the vulnerable component.

CISA publishes the decision points, not a final SSVC decision. The decision also depends on mission and well-being impact, which is a property of your deployment rather than of the vulnerability.

EPSS probability

0.47% probability of exploitation activity in the next 30 days.

EPSS percentile

Equal to or higher than the score of 40.6% of scored records. A rank, not a probability.

NVD base score

7.5 (CVSS v3.x), scored by the NVD independently of the CNA.

NVD CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

NVD analysis status

Deferred. NVD last modified this record on 2026-10-19.

Red Hat severity

Moderate. Red Hat's rating for its own products, not a CVSS rating.

Exploit-prediction scores from FIRST. Independent scoring and analysis status from the NVD. Vendor severity from Red Hat. Exploitation assessment and catalog membership from CISA.

04 Metadata

Published

2025-11-12 10:46Z11 MO AGO

Last updated

2026-10-15 22:02Z13 DAYS AGO

Reserved

2025-04-16

Assigning CNA

Linux

Record state

PUBLISHED

Severity

High (CVSS 7.5)

CNA CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weaknesses

CWE-772Missing Release of Resource after Effective LifetimeBase

Data version

5.2

Document digest

6c535c9be53e19c41acf111727c5256202cbe91e899eedd5872d36af57b2fe2e

05 Affected products

VendorProductVersionsPlatforms

LinuxLinux5e0bc09a52b6169ce90f7ac6e195791adb16cec4 to < 11269c08013f4ee8b8f5edc6c56700acb34092d0, 9e6987f8937a7bd7516aa52f25cb7e12c0c92ee8 to < a28112cc55013cd8cbd5d36b5115a5b851151bd9, eaf0971fdabf2a93c1429dc6bedf3bbe85dffa30 to < 060ecc81240ef9d60d9485a3a5eb55a0d6e7a25c, 710c69dbaccdac312e32931abcb8499c1525d397 to < 7331925c247b03b7767b8cd93cfe1b7aa2377850, 710c69dbaccdac312e32931abcb8499c1525d397 to < 7a619f8c869117ffed08365b377f66b7e1d941b4, 710c69dbaccdac312e32931abcb8499c1525d397 to < db5a5406fb7e5337a074385c7a3e53c77f2c1bd3, 1d86f79287206deec36d63b89c741cf542b6cadd, 5.15.150 to < 5.15.195, 6.1.80 to < 6.1.156, 6.6.19 to < 6.6.112, 6.7.7 to < 6.8, 6.8—

06 References

git.kernel.orghttps://git.kernel.org/stable/c/11269c08013f4ee8b8f5edc6c56700acb34092d0
git.kernel.orghttps://git.kernel.org/stable/c/a28112cc55013cd8cbd5d36b5115a5b851151bd9
git.kernel.orghttps://git.kernel.org/stable/c/060ecc81240ef9d60d9485a3a5eb55a0d6e7a25c
git.kernel.orghttps://git.kernel.org/stable/c/7331925c247b03b7767b8cd93cfe1b7aa2377850
git.kernel.orghttps://git.kernel.org/stable/c/7a619f8c869117ffed08365b377f66b7e1d941b4
git.kernel.orghttps://git.kernel.org/stable/c/db5a5406fb7e5337a074385c7a3e53c77f2c1bd3

07 Fixed in

Debian 12

linux
Fixed in 6.1.158-1

Source: Debian Security Tracker, the Debian security team. Received through OSV.dev. Reformatted by exploit.cc.

Debian 13

linux
Fixed in 6.12.57-1

Source: Debian Security Tracker, the Debian security team. Received through OSV.dev. Reformatted by exploit.cc.

Debian 14

linux
Fixed in 6.17.6-1

Source: Debian Security Tracker, the Debian security team. Received through OSV.dev. Reformatted by exploit.cc.