CVE-2026-89970

Description

In the Linux kernel, the following vulnerability has been resolved: nvmet-auth: Synchronize timeout work during SQ teardown nvmet_auth_sq_free() cancels auth_expired_work with cancel_delayed_work(). If the work has already started, cancellation does not wait for the callback. Transport teardown can consequently free or reuse the queue containing struct nvmet_sq while nvmet_auth_expired_work() still accesses that SQ. Add a teardown-specific helper that synchronously drains the delayed work before freeing authentication state, and use it from nvmet_sq_destroy(). Keep the non-synchronous helper for in-band authentication state cleanup, where the SQ owner remains alive.

CVSS 3.1 breakdown

Remediation

No fixed version is recorded in the NVD data. Check the vendor advisory for the latest guidance.

References

• https://git.kernel.org/stable/c/664022fa1c93f4eba09ef5ee02411b9709dd7a93
• https://git.kernel.org/stable/c/7555ddd60af72df2862dd8f9b730a9848577edda
• https://git.kernel.org/stable/c/c17c87bde6d6f5252a6a6f0a94b2430164aa28d5
• https://git.kernel.org/stable/c/c3c126a6142a1335bc8c34a5607c39cf01daf295
• https://git.kernel.org/stable/c/eaa948c0e19b1bb2d93262207bca0c3d19cc3406
• https://git.kernel.org/stable/c/eb4f9127a2b8a152743f1ee597627e2f69cb54fe

Frequently asked