CVE-2026-89970

9.8 CRITICAL

Published 2026-09-16 · Updated 2026-09-16

AI risk analysis

Summary: This vulnerability allows unauthorized access to storage queues during teardown, potentially leading to data corruption or theft.
Exploitability: Exploitation requires access to the affected Linux kernel version and specific timing conditions during queue teardown.
Blast radius: If exploited, this could result in significant data loss or compromise of sensitive information stored on the system.
Prioritized remediation: Update to a patched version of the Linux kernel as soon as possible.

kernelstorageteardownsynchronization

Analysis generated locally by qwen2.5:7b-instruct (no data left the box). AI-assisted — verify against primary sources before acting.

NVD description

In the Linux kernel, the following vulnerability has been resolved: nvmet-auth: Synchronize timeout work during SQ teardown nvmet_auth_sq_free() cancels auth_expired_work with cancel_delayed_work(). If the work has already started, cancellation does not wait for the callback. Transport teardown can consequently free or reuse the queue containing struct nvmet_sq while nvmet_auth_expired_work() still accesses that SQ. Add a teardown-specific helper that synchronously drains the delayed work before freeing authentication state, and use it from nvmet_sq_destroy(). Keep the non-synchronous helper for in-band authentication state cleanup, where the SQ owner remains alive.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

All references

Source data: NVD (nvd.nist.gov), public domain. Exploit-DB.ai adds local AI analysis for defensive use only.

Related CVEs

Related by shared AI tags and CWE weakness class. Browse the full archive.