CVE-2026-89972nvme: add missing SRCU grace period in error path
Updated under an hour ago ()
Does this affect you?
It affects Linux. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: nvme: add missing SRCU grace period in error path nvme_alloc_ns() error path at out_unlink_ns removes ns from the namespace head siblings list with list_del_rcu(&ns->siblings) but does not wait for SRCU readers before freeing the namespace struct. Multipath code iterates the head->list under srcu_read_lock() in nvme_find_path() and nvme_mpath_revalidate_paths(), so a concurrent reader can still hold a reference to ns when kfree(ns) runs. The normal removal path in nvme_ns_remove() correctly calls synchronize_srcu(&ns->head->srcu) after list_del_rcu() to wait for in-progress readers. Add the same grace period in the error path.
- CVSS
- 9.8 CRITICAL (v3.1, CNA)CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Linux
- NVD analysis
- Received
- Record last updated
- Oct 3, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Linux Linux linux:linux (from the name) | from ed754e5deeb17f4e675c84e4b6c640cc7344e498 before 0d4735418512ef825176726eaaa8bd6a35f6b46d; from ed754e5deeb17f4e675c84e4b6c640cc7344e498 before d663944dbad81bb0e3635d7090db4713e6300858; from ed754e5deeb17f4e675c84e4b6c640cc7344e498 before 76023560d60f10b4f808941163aa2975f1631683; from ed754e5deeb17f4e675c84e4b6c640cc7344e498 before ef248d5de4469fb6bbaf8dbe0c4c47800080d648 | CNA record |
References
- https://git.kernel.org/stable/c/0d4735418512ef825176726eaaa8bd6a35f6b46d
- https://git.kernel.org/stable/c/d663944dbad81bb0e3635d7090db4713e6300858
- https://git.kernel.org/stable/c/76023560d60f10b4f808941163aa2975f1631683
- https://git.kernel.org/stable/c/ef248d5de4469fb6bbaf8dbe0c4c47800080d648
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.