{"id":"CVE-2026-89970","published":"2026-09-16T11:17:07.660","lastModified":"2026-09-16T15:18:21.387","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nnvmet-auth: Synchronize timeout work during SQ teardown\n\nnvmet_auth_sq_free() cancels auth_expired_work with\ncancel_delayed_work(). If the work has already started, cancellation does\nnot wait for the callback. Transport teardown can consequently free or\nreuse the queue containing struct nvmet_sq while\nnvmet_auth_expired_work() still accesses that SQ.\n\nAdd a teardown-specific helper that synchronously drains the delayed work\nbefore freeing authentication state, and use it from nvmet_sq_destroy().\nKeep the non-synchronous helper for in-band authentication state cleanup,\nwhere the SQ owner remains alive.","cvssScore":9.8,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cwes":[],"vendors":[],"products":[],"references":[{"url":"https://git.kernel.org/stable/c/664022fa1c93f4eba09ef5ee02411b9709dd7a93","tags":[]},{"url":"https://git.kernel.org/stable/c/7555ddd60af72df2862dd8f9b730a9848577edda","tags":[]},{"url":"https://git.kernel.org/stable/c/c17c87bde6d6f5252a6a6f0a94b2430164aa28d5","tags":[]},{"url":"https://git.kernel.org/stable/c/c3c126a6142a1335bc8c34a5607c39cf01daf295","tags":[]},{"url":"https://git.kernel.org/stable/c/eaa948c0e19b1bb2d93262207bca0c3d19cc3406","tags":[]},{"url":"https://git.kernel.org/stable/c/eb4f9127a2b8a152743f1ee597627e2f69cb54fe","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"This vulnerability allows unauthorized access to storage queues during teardown, potentially leading to data corruption or theft.","exploitability":"Exploitation requires access to the affected Linux kernel version and specific timing conditions during queue teardown.","blast_radius":"If exploited, this could result in significant data loss or compromise of sensitive information stored on the system.","remediation":"Update to a patched version of the Linux kernel as soon as possible.","tags":["kernel","storage","teardown","synchronization"],"model":"qwen2.5:7b-instruct","analyzedAt":"2026-09-23T08:44:27.084Z"}}