CVE-2026-89972 nvme: add missing SRCU grace period in error path
A missing SRCU grace period in the Linux kernel NVMe driver error path allows a use-after-free, potentially leading to code execution or system crashes.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-89972?
CVE-2026-89972 is a critical use after free vulnerability in Linux, published on 16 Sep 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
nvme: add missing SRCU grace period in error path
nvme_alloc_ns() error path at out_unlink_ns removes ns from the namespace head siblings list with list_del_rcu(&ns->siblings) but does not wait for SRCU readers before freeing the namespace struct. Multipath code iterates the head->list under srcu_read_lock() in nvme_find_path() and nvme_mpath_revalidate_paths(), so a concurrent reader can still hold a reference to ns when kfree(ns) runs.
The normal removal path in nvme_ns_remove() correctly calls synchronize_srcu(&ns->head->srcu) after list_del_rcu() to wait for in-progress readers. Add the same grace period in the error path.
Which versions are affected by CVE-2026-89972?
How do I fix CVE-2026-89972?
Apply the vendor's patch.
Upgrade to the fixed version. These bugs are found with fuzzing and sanitisers and avoided by memory-safe languages. More about Use after free.
Is CVE-2026-89972 being exploited?
There is no known exploitation of CVE-2026-89972 in the wild and no public exploit code.
Sources
Also known as AZL-101552, BELL-CVE-2026-89972, DEBIAN-CVE-2026-89972, GHSA-cjx2-56hv-4vc4, UBUNTU-CVE-2026-89972.