{"id":"CVE-2026-89972","published":"2026-09-16T11:17:07.953","lastModified":"2026-09-16T15:18:21.637","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nnvme: add missing SRCU grace period in error path\n\nnvme_alloc_ns() error path at out_unlink_ns removes ns from the\nnamespace head siblings list with list_del_rcu(&ns->siblings) but\ndoes not wait for SRCU readers before freeing the namespace struct.\nMultipath code iterates the head->list under srcu_read_lock() in\nnvme_find_path() and nvme_mpath_revalidate_paths(), so a concurrent\nreader can still hold a reference to ns when kfree(ns) runs.\n\nThe normal removal path in nvme_ns_remove() correctly calls\nsynchronize_srcu(&ns->head->srcu) after list_del_rcu() to wait for\nin-progress readers. Add the same grace period in the error path.","cvssScore":9.8,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cwes":[],"vendors":[],"products":[],"references":[{"url":"https://git.kernel.org/stable/c/76023560d60f10b4f808941163aa2975f1631683","tags":[]},{"url":"https://git.kernel.org/stable/c/d663944dbad81bb0e3635d7090db4713e6300858","tags":[]},{"url":"https://git.kernel.org/stable/c/ef248d5de4469fb6bbaf8dbe0c4c47800080d648","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"This flaw allows a concurrent reader to hold a reference to an ns struct after it has been removed from the namespace head siblings list, leading to potential memory corruption or other issues when kfree(ns) runs.","exploitability":"Exploitation requires concurrent access by multipath code during namespace removal, making it moderately difficult but feasible with specific conditions.","blast_radius":"If exploited, this could lead to severe system instability or security vulnerabilities affecting the Linux kernel's stability and integrity.","remediation":"Apply the patch that adds a SRCU grace period in the error path of nvme_alloc_ns() to ensure proper synchronization before freeing the namespace struct.","tags":["kernel","memory-corruption","srcu","stability"],"model":"qwen2.5:7b-instruct","analyzedAt":"2026-09-23T08:44:38.809Z"}}