CVE-2026-89972

nvme: add missing SRCU grace period in error path

State: Published
Severity: 9.8 Critical
Published: Sep 16, 2026
Updated: Oct 30, 2026
Reserved: Sep 11, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

nvme: add missing SRCU grace period in error path

nvme_alloc_ns() error path at out_unlink_ns removes ns from the namespace head siblings list with list_del_rcu(&ns->siblings) but does not wait for SRCU readers before freeing the namespace struct. Multipath code iterates the head->list under srcu_read_lock() in nvme_find_path() and nvme_mpath_revalidate_paths(), so a concurrent reader can still hold a reference to ns when kfree(ns) runs.

The normal removal path in nvme_ns_remove() correctly calls synchronize_srcu(&ns->head->srcu) after list_del_rcu() to wait for in-progress readers. Add the same grace period in the error path.

Scores

CVSS	Score	Vector	Source
3.1	9.8 Critical	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	Linux

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	ed754e5deeb17f4e675c84e4b6c640cc7344e498 to before 037e71058e8a59568db72015d4386f54e54dff77Affected ed754e5deeb17f4e675c84e4b6c640cc7344e498 to before 7f180cef9f3421ece85c43bfdc326ce5875845bbAffected ed754e5deeb17f4e675c84e4b6c640cc7344e498 to before da710ec2a70a85de73afd4f7869b234fd9ede49eAffected ed754e5deeb17f4e675c84e4b6c640cc7344e498 to before 3868476cd39161f18720582df17a1b621e805b5dAffected ed754e5deeb17f4e675c84e4b6c640cc7344e498 to before 0d4735418512ef825176726eaaa8bd6a35f6b46dAffected ed754e5deeb17f4e675c84e4b6c640cc7344e498 to before d663944dbad81bb0e3635d7090db4713e6300858Affected ed754e5deeb17f4e675c84e4b6c640cc7344e498 to before 76023560d60f10b4f808941163aa2975f1631683Affected ed754e5deeb17f4e675c84e4b6c640cc7344e498 to before ef248d5de4469fb6bbaf8dbe0c4c47800080d648Affected
LinuxLinux	4.15Affected before 4.15Not affected 5.10.273 through 5.10.Not affected 5.15.224 through 5.15.Not affected 6.1.191 through 6.1.Not affected 6.6.160 through 6.6.Not affected 6.12.112 through 6.12.Not affected 6.18.51 through 6.18.Not affected 7.2.5 through 7.2.*Not affected 7.3 and laterNot affected

Product

Versions

LinuxLinux

ed754e5deeb17f4e675c84e4b6c640cc7344e498 to before 037e71058e8a59568db72015d4386f54e54dff77Affected
ed754e5deeb17f4e675c84e4b6c640cc7344e498 to before 7f180cef9f3421ece85c43bfdc326ce5875845bbAffected
ed754e5deeb17f4e675c84e4b6c640cc7344e498 to before da710ec2a70a85de73afd4f7869b234fd9ede49eAffected
ed754e5deeb17f4e675c84e4b6c640cc7344e498 to before 3868476cd39161f18720582df17a1b621e805b5dAffected
ed754e5deeb17f4e675c84e4b6c640cc7344e498 to before 0d4735418512ef825176726eaaa8bd6a35f6b46dAffected
ed754e5deeb17f4e675c84e4b6c640cc7344e498 to before d663944dbad81bb0e3635d7090db4713e6300858Affected
ed754e5deeb17f4e675c84e4b6c640cc7344e498 to before 76023560d60f10b4f808941163aa2975f1631683Affected
ed754e5deeb17f4e675c84e4b6c640cc7344e498 to before ef248d5de4469fb6bbaf8dbe0c4c47800080d648Affected

LinuxLinux

4.15Affected
before 4.15Not affected
5.10.273 through 5.10.*Not affected
5.15.224 through 5.15.*Not affected
6.1.191 through 6.1.*Not affected
6.6.160 through 6.6.*Not affected
6.12.112 through 6.12.*Not affected
6.18.51 through 6.18.*Not affected
7.2.5 through 7.2.*Not affected
7.3 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.