{"id":"CVE-2026-89972","published":"2026-09-16T11:17:07.953","lastModified":"2026-09-16T15:18:21.637","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nnvme: add missing SRCU grace period in error path\n\nnvme_alloc_ns() error path at out_unlink_ns removes ns from the\nnamespace head siblings list with list_del_rcu(&ns->siblings) but\ndoes not wait for SRCU readers before freeing the namespace struct.\nMultipath code iterates the head->list under srcu_read_lock() in\nnvme_find_path() and nvme_mpath_revalidate_paths(), so a concurrent\nreader can still hold a reference to ns when kfree(ns) runs.\n\nThe normal removal path in nvme_ns_remove() correctly calls\nsynchronize_srcu(&ns->head->srcu) after list_del_rcu() to wait for\nin-progress readers. Add the same grace period in the error path.","cvssScore":9.8,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cwes":[],"vendors":[],"products":[],"references":[{"url":"https://git.kernel.org/stable/c/76023560d60f10b4f808941163aa2975f1631683","tags":[]},{"url":"https://git.kernel.org/stable/c/d663944dbad81bb0e3635d7090db4713e6300858","tags":[]},{"url":"https://git.kernel.org/stable/c/ef248d5de4469fb6bbaf8dbe0c4c47800080d648","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"This flaw in the Linux kernel's NVMe driver allows concurrent readers to hold a reference to a namespace structure that is being freed, potentially leading to a use-after-free condition.","exploitability":"Exploitation requires concurrent access to the namespace list and the ability to trigger the error path in the NVMe driver. This is moderately difficult and requires specific timing and conditions.","blast_radius":"If exploited, this could lead to arbitrary code execution or denial of service conditions, depending on the context in which the namespace is used.","remediation":"Upgrade to the specific version mentioned in the fix: 'Upgrade to v5.19-rc1 or later'.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["kernel","use-after-free","nvme","critical"],"model":"qwen2.5:7b-instruct","analyzedAt":"2026-09-28T08:58:45.999Z"}}