CVE-2026-89970

nvmet-auth: Synchronize timeout work during SQ teardown

State: Published
Severity: 9.8 Critical
Published: Sep 16, 2026
Updated: Oct 19, 2026
Reserved: Sep 11, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

nvmet-auth: Synchronize timeout work during SQ teardown

nvmet_auth_sq_free() cancels auth_expired_work with cancel_delayed_work(). If the work has already started, cancellation does not wait for the callback. Transport teardown can consequently free or reuse the queue containing struct nvmet_sq while nvmet_auth_expired_work() still accesses that SQ.

Add a teardown-specific helper that synchronously drains the delayed work before freeing authentication state, and use it from nvmet_sq_destroy(). Keep the non-synchronous helper for in-band authentication state cleanup, where the SQ owner remains alive.

Scores

CVSS	Score	Vector	Source
3.1	9.8 Critical	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	Linux

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	1a70200f404ae210b4f0334e3936e84f8edb6bc8 to before 664022fa1c93f4eba09ef5ee02411b9709dd7a93Affected 1a70200f404ae210b4f0334e3936e84f8edb6bc8 to before c3c126a6142a1335bc8c34a5607c39cf01daf295Affected 1a70200f404ae210b4f0334e3936e84f8edb6bc8 to before c17c87bde6d6f5252a6a6f0a94b2430164aa28d5Affected 1a70200f404ae210b4f0334e3936e84f8edb6bc8 to before 7555ddd60af72df2862dd8f9b730a9848577eddaAffected 1a70200f404ae210b4f0334e3936e84f8edb6bc8 to before eb4f9127a2b8a152743f1ee597627e2f69cb54feAffected 1a70200f404ae210b4f0334e3936e84f8edb6bc8 to before eaa948c0e19b1bb2d93262207bca0c3d19cc3406Affected
LinuxLinux	6.0Affected before 6.0Not affected 6.1.188 through 6.1.Not affected 6.6.157 through 6.6.Not affected 6.12.110 through 6.12.Not affected 6.18.51 through 6.18.Not affected 7.2.5 through 7.2.*Not affected 7.3 and laterNot affected

Product

Versions

LinuxLinux

1a70200f404ae210b4f0334e3936e84f8edb6bc8 to before 664022fa1c93f4eba09ef5ee02411b9709dd7a93Affected
1a70200f404ae210b4f0334e3936e84f8edb6bc8 to before c3c126a6142a1335bc8c34a5607c39cf01daf295Affected
1a70200f404ae210b4f0334e3936e84f8edb6bc8 to before c17c87bde6d6f5252a6a6f0a94b2430164aa28d5Affected
1a70200f404ae210b4f0334e3936e84f8edb6bc8 to before 7555ddd60af72df2862dd8f9b730a9848577eddaAffected
1a70200f404ae210b4f0334e3936e84f8edb6bc8 to before eb4f9127a2b8a152743f1ee597627e2f69cb54feAffected
1a70200f404ae210b4f0334e3936e84f8edb6bc8 to before eaa948c0e19b1bb2d93262207bca0c3d19cc3406Affected

LinuxLinux

6.0Affected
before 6.0Not affected
6.1.188 through 6.1.*Not affected
6.6.157 through 6.6.*Not affected
6.12.110 through 6.12.*Not affected
6.18.51 through 6.18.*Not affected
7.2.5 through 7.2.*Not affected
7.3 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.