Skip to content
CVE PROGRAM SOURCE RECORD9.8 Critical

CVE-2026-89970

nvmet-auth: Synchronize timeout work during SQ teardown

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
Linux

Description

In the Linux kernel, the following vulnerability has been resolved: nvmet-auth: Synchronize timeout work during SQ teardown nvmet_auth_sq_free() cancels auth_expired_work with cancel_delayed_work(). If the work has already started, cancellation does not wait for the callback. Transport teardown can consequently free or reuse the queue containing struct nvmet_sq while nvmet_auth_expired_work() still accesses that SQ. Add a teardown-specific helper that synchronously drains the delayed work before freeing authentication state, and use it from nvmet_sq_destroy(). Keep the non-synchronous helper for in-band authentication state cleanup, where the SQ owner remains alive.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Linux Linux

Default version status: unaffected

  • 1a70200f404ae210b4f0334e3936e84f8edb6bc8 to < 664022fa1c93f4eba09ef5ee02411b9709dd7a93affected
  • 1a70200f404ae210b4f0334e3936e84f8edb6bc8 to < c3c126a6142a1335bc8c34a5607c39cf01daf295affected
  • 1a70200f404ae210b4f0334e3936e84f8edb6bc8 to < c17c87bde6d6f5252a6a6f0a94b2430164aa28d5affected
  • 1a70200f404ae210b4f0334e3936e84f8edb6bc8 to < 7555ddd60af72df2862dd8f9b730a9848577eddaaffected
  • 1a70200f404ae210b4f0334e3936e84f8edb6bc8 to < eb4f9127a2b8a152743f1ee597627e2f69cb54feaffected
  • 1a70200f404ae210b4f0334e3936e84f8edb6bc8 to < eaa948c0e19b1bb2d93262207bca0c3d19cc3406affected

Linux Linux

Default version status: affected

  • 6.0affected
  • 0 to < 6.0unaffected
  • 6.1.188 to ≤ 6.1.*unaffected
  • 6.6.157 to ≤ 6.6.*unaffected
  • 6.12.110 to ≤ 6.12.*unaffected
  • 6.18.51 to ≤ 6.18.*unaffected
  • 7.2.5 to ≤ 7.2.*unaffected
  • 7.3 to ≤ *unaffected

References