CVE-2026-89970nvmet-auth: Synchronize timeout work during SQ teardown
Updated under an hour ago ()
Does this affect you?
It affects Linux. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: nvmet-auth: Synchronize timeout work during SQ teardown nvmet_auth_sq_free() cancels auth_expired_work with cancel_delayed_work(). If the work has already started, cancellation does not wait for the callback. Transport teardown can consequently free or reuse the queue containing struct nvmet_sq while nvmet_auth_expired_work() still accesses that SQ. Add a teardown-specific helper that synchronously drains the delayed work before freeing authentication state, and use it from nvmet_sq_destroy(). Keep the non-synchronous helper for in-band authentication state cleanup, where the SQ owner remains alive.
- CVSS
- 9.8 CRITICAL (v3.1, CNA)CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Linux
- NVD analysis
- Received
- Record last updated
- Oct 19, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Linux Linux linux:linux (from the name) | from 1a70200f404ae210b4f0334e3936e84f8edb6bc8 before 664022fa1c93f4eba09ef5ee02411b9709dd7a93; from 1a70200f404ae210b4f0334e3936e84f8edb6bc8 before c3c126a6142a1335bc8c34a5607c39cf01daf295; from 1a70200f404ae210b4f0334e3936e84f8edb6bc8 before c17c87bde6d6f5252a6a6f0a94b2430164aa28d5; from 1a70200f404ae210b4f0334e3936e84f8edb6bc8 before 7555ddd60af72df2862dd8f9b730a9848577edda; from 1a70200f404ae210b4f0334e3936e84f8edb6bc8 before eb4f9127a2b8a152743f1ee597627e2f69cb54fe; from 1a70200f404ae210b4f0334e3936e84f8edb6bc8 before eaa948c0e19b1bb2d93262207bca0c3d19cc3406 | CNA record |
References
- https://git.kernel.org/stable/c/664022fa1c93f4eba09ef5ee02411b9709dd7a93
- https://git.kernel.org/stable/c/c3c126a6142a1335bc8c34a5607c39cf01daf295
- https://git.kernel.org/stable/c/c17c87bde6d6f5252a6a6f0a94b2430164aa28d5
- https://git.kernel.org/stable/c/7555ddd60af72df2862dd8f9b730a9848577edda
- https://git.kernel.org/stable/c/eb4f9127a2b8a152743f1ee597627e2f69cb54fe
- https://git.kernel.org/stable/c/eaa948c0e19b1bb2d93262207bca0c3d19cc3406
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.