CVE-2026-89970 nvmet-auth: Synchronize timeout work during SQ teardown
A race condition in Linux kernel NVMe target authentication allows use-after-free during queue teardown, potentially leading to code execution or denial of service.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-89970?
CVE-2026-89970 is a critical vulnerability in Linux, published on 16 Sep 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
nvmet-auth: Synchronize timeout work during SQ teardown
nvmet_auth_sq_free() cancels auth_expired_work with cancel_delayed_work(). If the work has already started, cancellation does not wait for the callback. Transport teardown can consequently free or reuse the queue containing struct nvmet_sq while nvmet_auth_expired_work() still accesses that SQ.
Add a teardown-specific helper that synchronously drains the delayed work before freeing authentication state, and use it from nvmet_sq_destroy(). Keep the non-synchronous helper for in-band authentication state cleanup, where the SQ owner remains alive.
Which versions are affected by CVE-2026-89970?
How do I fix CVE-2026-89970?
Apply the vendor's patch.
Is CVE-2026-89970 being exploited?
There is no known exploitation of CVE-2026-89970 in the wild and no public exploit code.
Sources
Also known as AZL-101460, BELL-CVE-2026-89970, DEBIAN-CVE-2026-89970, GHSA-p375-rp8x-7v2g, UBUNTU-CVE-2026-89970.