SECUFOCUSNOW
Home›CVE index›CVE-2025-40261
Review reviewCritical

CVE-2025-40261

Linux Linux, RUGGEDCOM RST2428P, SIMATIC S7-1500 CPU 1518-4 PN/DP MFP

In the Linux kernel, the following vulnerability has been resolved: nvme: nvme-fc: Ensure ->ioerr_work is cancelled in nvme_fc_delete_ctrl() nvme_fc_delete_assocation() waits for pending I/O to complete before returning, and an error can cause ->ioerr_work to be queued after cancel_work_sync() had been called. Move the call to cancel_work_sync() to be after nvme_fc_delete_association() to ensure ->ioerr_work is not running when the nvme_fc_ctrl object is freed. Otherwise the following can occur: [ 1135.911754] list_del corruption, ff2d24c8093f31f8->next is NULL [ 1135.917705] ------------[...

CVSS
9.8
EPSS
0.55%
43.0% percentile
CISA KEV
Not listed
Published
2025.12.05
PRIORITY ASSESSMENT

Review review

The CVSS severity warrants an early asset and exposure review.

Known exploitationNot established by KEV
Exploit probability0.55%
Technical severityCVSS 9.8

Vulnerability overview

In the Linux kernel, the following vulnerability has been resolved: nvme: nvme-fc: Ensure ->ioerr_work is cancelled in nvme_fc_delete_ctrl() nvme_fc_delete_assocation() waits for pending I/O to complete before returning, and an error can cause ->ioerr_work to be queued after cancel_work_sync() had been called. Move the call to cancel_work_sync() to be after nvme_fc_delete_association() to ensure ->ioerr_work is not running when the nvme_fc_ctrl object is freed. Otherwise the following can occur: [ 1135.911754] list_del corruption, ff2d24c8093f31f8->next is NULL [ 1135.917705] ------------[...

Affected product and versions

Product
Linux Linux, RUGGEDCOM RST2428P, SIMATIC S7-1500 CPU 1518-4 PN/DP MFP
Affected versions
>= f1cd8c40936ff2b560e1f35159dd6a4602b558e5 < 3f48cd7f35da07fc067cef926bb7f6f4735de37b, >= 19fce0470f05031e6af36e49ce222d0f0050d432 < a9b1315ed428239612601e9e188329e7cefa32fd, >= 19fce0470f05031e6af36e49ce222d0f0050d432 < 9610a2c162ef729a3988213a4604376e492f6f44, >= 19fce0470f05031e6af36e49ce222d0f0050d432 < 33f64600a12055219bda38b55320c62cdeda9167, >= 19fce0470f05031e6af36e49ce222d0f0050d432 < 48ae433c6cc6985f647b1b37d8bb002972cf9bdb, >= 19fce0470f05031e6af36e49ce222d0f0050d432 < fbd5741a556eaaa63d0908132ca79d335b58b1cd, >= 19fce0470f05031e6af36e49ce222d0f0050d432 < 0a2c5495b6d1ecb0fa18ef6631450f391a888256, >= 5.10.9 < 5.10.253, >= 5.11, < V4.0, >= V3.1.6, >= V3.1.5
Fixed versions
No verified fixed-version field is available yet

Recommended response sequence

Confirm exposure before applying a vendor-supported change.

Full remediation guide
  1. 1
    Identify

    Confirm that Linux Linux, RUGGEDCOM RST2428P, SIMATIC S7-1500 CPU 1518-4 PN/DP MFP and an affected version are present.

  2. 2
    Prioritize

    Combine exploitation signals with asset exposure and business criticality.

  3. 3
    Remediate

    Follow the vendor advisory or supported update path and preserve rollback options.

  4. 4
    Verify

    Recheck the version, service health, access paths, and relevant logs.

Technical data

CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CWE
Not available