CVE-2026-80589

Received Received - Intake

Kernel timer use-after-free in NVMe driver

Publication date: 2026-08-26

Last updated on: 2026-08-27

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: block: stop the timeout timer when releasing a never added disk disk_release() undoes blk_mq_init_allocated_queue() for a disk whose probe failed before add_disk(), but it only calls blk_mq_exit_queue(). Nothing there stops q->timeout, and that timer rolls forward: it stays pending until it next expires, not until the last request completes. So if the driver issued any I/O before adding the disk, the request_queue is freed while still linked into a timer wheel bucket. Commit 6f8191fdf41d ("block: simplify disk shutdown") dropped the blk_cleanup_queue() call that used to stop it. __del_gendisk() and blk_mq_destroy_queue() still do; only the probe failure path lost it. nvme gets there because nvme_update_ns_info() submits Report Zones or FDP io-mgmt-recv on ns->queue before the disk is added, so a later failure - a concurrent reset setting NVME_CTRL_FROZEN, or device_add_disk() failing - lands in put_disk() with the timer armed: BUG: KASAN: slab-use-after-free in detach_if_pending+0x30c/0x340 Write of size 8 at addr ffff888004d71310 by task kworker/u8:2/37 __timer_delete_sync+0x156/0x240 kernel/time/timer.c:1621 blk_sync_queue+0x22/0x40 block/blk-core.c:222 nvme_sync_queues+0x100/0x150 drivers/nvme/host/core.c:5362 nvme_reset_work+0x138/0x930 drivers/nvme/host/pci.c:3264 Allocated by task 34: __blk_mq_alloc_disk+0x33/0x100 block/blk-mq.c:4462 nvme_alloc_ns+0x290/0x3870 drivers/nvme/host/core.c:4146 Freed by task 0: blk_free_queue_rcu+0x3a/0x50 block/blk-core.c:254 rcu_core+0xc10/0x1730 kernel/rcu/tree.c:2857 The queue being synced there is ctrl->admin_q, only a victim sharing a timer wheel bucket with the freed queue's dangling entry; other runs tripped in enqueue_timer(), __run_timers() or blk_mq_timeout_work(). Failing nvme_alloc_ns() with a debug patch makes it deterministic: one leaked timer trips KASAN within seconds, while 1987 patched releases produced no splat. Stop the timer and the queue work items before blk_mq_exit_queue(), like blk_mq_destroy_queue() does. Found by FuzzNvme.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-26

Last Modified

2026-08-27

Generated

2026-09-16

AI Q&A

2026-08-26

EPSS Evaluated

2026-09-14

NVD

CVE-2026-80589

EUVD

EUVD-2026-66504

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	*
linux_kernel	linux_kernel	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability in the Linux kernel involves a timer not being properly stopped when a disk fails to initialize before being added. When a disk probe fails, the system attempts to clean up but misses stopping a timer linked to the disk's request queue. This timer remains active and can cause a use-after-free error when later accessed, leading to system instability or crashes.

Detection Guidance

This vulnerability is specific to the Linux kernel and involves a timer issue in block device handling. Detection requires kernel logs showing slab-use-after-free errors related to timer operations in block devices. Check system logs for KASAN reports or kernel oops messages indicating timer-related crashes in block layer operations.

Impact Analysis

This vulnerability can cause system crashes or instability due to use-after-free errors. It may lead to kernel panics, data corruption, or denial-of-service conditions if exploited. Systems using NVMe drives are particularly affected due to their I/O operations before disk addition.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR, HIPAA, or similar standards as it is a low-level kernel memory management issue unrelated to data protection, privacy, or security controls required by these regulations.

Mitigation Strategies

Apply the kernel patch that stops the timeout timer when disk probe fails. Update to a kernel version containing commit 6f8191fdf41d or later. Monitor kernel logs for block device-related crashes or timer issues as a sign of exploitation.

Hi! I’m here to help you understand CVE-2026-80589. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70