{"id":"CVE-2026-89970","published":"2026-09-16T11:17:07.660","lastModified":"2026-09-16T15:18:21.387","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nnvmet-auth: Synchronize timeout work during SQ teardown\n\nnvmet_auth_sq_free() cancels auth_expired_work with\ncancel_delayed_work(). If the work has already started, cancellation does\nnot wait for the callback. Transport teardown can consequently free or\nreuse the queue containing struct nvmet_sq while\nnvmet_auth_expired_work() still accesses that SQ.\n\nAdd a teardown-specific helper that synchronously drains the delayed work\nbefore freeing authentication state, and use it from nvmet_sq_destroy().\nKeep the non-synchronous helper for in-band authentication state cleanup,\nwhere the SQ owner remains alive.","cvssScore":9.8,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cwes":[],"vendors":[],"products":[],"references":[{"url":"https://git.kernel.org/stable/c/664022fa1c93f4eba09ef5ee02411b9709dd7a93","tags":[]},{"url":"https://git.kernel.org/stable/c/7555ddd60af72df2862dd8f9b730a9848577edda","tags":[]},{"url":"https://git.kernel.org/stable/c/c17c87bde6d6f5252a6a6f0a94b2430164aa28d5","tags":[]},{"url":"https://git.kernel.org/stable/c/c3c126a6142a1335bc8c34a5607c39cf01daf295","tags":[]},{"url":"https://git.kernel.org/stable/c/eaa948c0e19b1bb2d93262207bca0c3d19cc3406","tags":[]},{"url":"https://git.kernel.org/stable/c/eb4f9127a2b8a152743f1ee597627e2f69cb54fe","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"This vulnerability in the Linux kernel's NVMe over Fabrics (NVMe-oF) authentication mechanism allows an attacker to prematurely free or reuse a queue, leading to potential data corruption or system instability.","exploitability":"Exploitation requires access to the affected NVMe-oF environment and knowledge of the specific SQ teardown process. The attacker must be able to trigger the SQ teardown while the authentication work is in progress.","blast_radius":"If exploited, the vulnerability could lead to data corruption, system crashes, or other severe consequences, impacting the integrity and availability of the storage system.","remediation":"Upgrade to the fixed version 5.19-rc1 or later.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["kernel","storage","authentication"],"model":"qwen2.5:7b-instruct","analyzedAt":"2026-09-29T09:07:53.569Z"}}