CVE-2026-80589 - Vulnerability Details

- block: stop the timeout timer when releasing a never added disk

Description

In the Linux kernel, the following vulnerability has been resolved:

block: stop the timeout timer when releasing a never added disk

disk_release() undoes blk_mq_init_allocated_queue() for a disk whose
probe failed before add_disk(), but it only calls blk_mq_exit_queue().
Nothing there stops q->timeout, and that timer rolls forward: it stays
pending until it next expires, not until the last request completes.
So if the driver issued any I/O before adding the disk, the
request_queue is freed while still linked into a timer wheel bucket.

Commit 6f8191fdf41d ("block: simplify disk shutdown") dropped the
blk_cleanup_queue() call that used to stop it. __del_gendisk() and
blk_mq_destroy_queue() still do; only the probe failure path lost it.

nvme gets there because nvme_update_ns_info() submits Report Zones or
FDP io-mgmt-recv on ns->queue before the disk is added, so a later
failure - a concurrent reset setting NVME_CTRL_FROZEN, or
device_add_disk() failing - lands in put_disk() with the timer armed:

BUG: KASAN: slab-use-after-free in detach_if_pending+0x30c/0x340
Write of size 8 at addr ffff888004d71310 by task kworker/u8:2/37
__timer_delete_sync+0x156/0x240 kernel/time/timer.c:1621
blk_sync_queue+0x22/0x40 block/blk-core.c:222
nvme_sync_queues+0x100/0x150 drivers/nvme/host/core.c:5362
nvme_reset_work+0x138/0x930 drivers/nvme/host/pci.c:3264

Allocated by task 34:
__blk_mq_alloc_disk+0x33/0x100 block/blk-mq.c:4462
nvme_alloc_ns+0x290/0x3870 drivers/nvme/host/core.c:4146

Freed by task 0:
blk_free_queue_rcu+0x3a/0x50 block/blk-core.c:254
rcu_core+0xc10/0x1730 kernel/rcu/tree.c:2857

The queue being synced there is ctrl->admin_q, only a victim sharing a
timer wheel bucket with the freed queue's dangling entry; other runs
tripped in enqueue_timer(), __run_timers() or blk_mq_timeout_work().
Failing nvme_alloc_ns() with a debug patch makes it deterministic: one
leaked timer trips KASAN within seconds, while 1987 patched releases
produced no splat.

Stop the timer and the queue work items before blk_mq_exit_queue(), like
blk_mq_destroy_queue() does.

Found by FuzzNvme.

Published: 2026-08-26

Score: 9.8 Critical

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

The Linux kernel disk shutdown code failed to cancel the timeout timer for a disk that never completed its addition. When an I/O request is issued before the disk is fully initialized, the request queue is freed while still linked to a timer wheel, triggering a use‑after‑free that can lead to a kernel crash or memory corruption. The vulnerability is a classic example of improper memory management and concurrent timer misuse (CWE‑825).

Affected Systems

All Linux kernel versions that incorporate the commit removing blk_cleanup_queue() from disk_release(), particularly those using NVMe devices that may submit I/O before a disk is fully added. Any system running a kernel without the fix in the block subsystem or the NVMe subsystem is potentially vulnerable.

Risk and Exploitability

The CVSS score of 9.8 shows a high severity. The EPSS score is very low (<1%), indicating a low probability of exploitation. The flaw requires an attacker to trigger I/O on a NVMe namespace during initialization while a concurrent reset or failure path causes the disk to remain armed. This suggests a local or privileged attacker could exploit the flaw, leading to a kernel crash or memory corruption. No public exploits are currently known, and the vulnerability is not listed in the CISA KEV catalog.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`6f8191fdf41d3a53cc1d63fe2234e812c55a0092`	affected	< 6ae7364f68e6c7af6b6df4bbb14040b89e5975d0
`6f8191fdf41d3a53cc1d63fe2234e812c55a0092`	affected	< 6f06dbe5012c160e0dba418a5a9cb16c456ad46a
`6f8191fdf41d3a53cc1d63fe2234e812c55a0092`	affected	< 1a0ae4d502062a2759f2a92d12bdeab3c64c7372
`6f8191fdf41d3a53cc1d63fe2234e812c55a0092`	affected	< bb03b56d1d754908a37a160603be21769da423cf
`6f8191fdf41d3a53cc1d63fe2234e812c55a0092`	affected	< 93d620519d71dfc6ee64b5baea74f1d85d4439fb
`6f8191fdf41d3a53cc1d63fe2234e812c55a0092`	affected	< 26cb8ebbfaf713c82e142d08828d4d765057633b
`d27b66257db183fe11c10f31246ae965adb005d3`	affected	—
`5.19.12`	affected	< 5.20

Linux

affected

Version	Status	Constraints
`6.0`	affected	—
`0`	unaffected	< 6.0
`6.1.184`	unaffected	≤ 6.1.*
`6.6.153`	unaffected	≤ 6.6.*
`6.12.105`	unaffected	≤ 6.12.*
`6.18.46`	unaffected	≤ 6.18.*
`7.1.10`	unaffected	≤ 7.1.*
`7.2`	unaffected	≤ *

No data.

Vendor Product Confidence Versions

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[6f8191fdf41d3a53cc1d63fe2234e812c55a0092,6ae7364f68e6c7af6b6df4bbb14040b89e5975d0)`	affected	code_commit	—
`[6f8191fdf41d3a53cc1d63fe2234e812c55a0092,6f06dbe5012c160e0dba418a5a9cb16c456ad46a)`	affected	code_commit	—
`[6f8191fdf41d3a53cc1d63fe2234e812c55a0092,1a0ae4d502062a2759f2a92d12bdeab3c64c7372)`	affected	code_commit	—
`[6f8191fdf41d3a53cc1d63fe2234e812c55a0092,bb03b56d1d754908a37a160603be21769da423cf)`	affected	code_commit	—
`[6f8191fdf41d3a53cc1d63fe2234e812c55a0092,93d620519d71dfc6ee64b5baea74f1d85d4439fb)`	affected	code_commit	—
`[6f8191fdf41d3a53cc1d63fe2234e812c55a0092,26cb8ebbfaf713c82e142d08828d4d765057633b)`	affected	code_commit	—
`d27b66257db183fe11c10f31246ae965adb005d3`	affected	code_commit	—
`[5.19.12,5.20)`	affected	semver	—

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`6.0`	affected	semver	—
`[0,6.0)`	unaffected	semver	—
`[6.1.184,6.2.0)`	unaffected	semver	—
`[6.6.153,6.7.0)`	unaffected	semver	—
`[6.12.105,6.13.0)`	unaffected	semver	—
`[6.18.46,6.19.0)`	unaffected	semver	—
`[7.1.10,7.2.0)`	unaffected	semver	—
`[7.2, *]`	unaffected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

Apply a kernel update that includes commit 6f8191f, which restores timeout timer cleanup during disk shutdown.
If a distribution update is not immediately available, patch the kernel source with commit 6f8191f and rebuild the kernel.
Until the patch is deployed, disable NVMe device I/O or remove NVMe devices from the system to mitigate the use‑after‑free risk.

Generated by OpenCVE AI on August 28, 2026 at 19:22 UTC.

Tracking

Sign in to view the affected projects.

Advisories

Source	ID	Title
Debian DLA	DLA-4777-1	linux security update

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00375.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/1a0ae4d502062a2759f2a92d12bdeab3c64c7372
https://git.kernel.org/stable/c/26cb8ebbfaf713c82e142d08828d4d765057633b
https://git.kernel.org/stable/c/6ae7364f68e6c7af6b6df4bbb14040b89e5975d0
https://git.kernel.org/stable/c/6f06dbe5012c160e0dba418a5a9cb16c456ad46a
https://git.kernel.org/stable/c/93d620519d71dfc6ee64b5baea74f1d85d4439fb
https://git.kernel.org/stable/c/bb03b56d1d754908a37a160603be21769da423cf
https://lore.kernel.org/linux-cve-announce/2026082617-CVE-2026-80589-81b6@gregkh/T
https://nvd.nist.gov/vuln/detail/CVE-2026-80589
https://www.cve.org/CVERecord?id=CVE-2026-80589

History

Fri, 28 Aug 2026 18:15:00 +0000

Type	Values Removed	Values Added
Weaknesses	CWE-416

Thu, 27 Aug 2026 18:00:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-825
References		https://lore.kernel.org/linux-cve-announce/2026082617-CVE-2026-80589-81b6@gregkh/T https://nvd.nist.gov/vuln/detail/CVE-2026-80589 https://www.cve.org/CVERecord?id=CVE-2026-80589
Metrics	threat_severity `None`	threat_severity `Moderate`

Thu, 27 Aug 2026 10:30:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-416

Thu, 27 Aug 2026 08:30:00 +0000

Type	Values Removed	Values Added
Weaknesses	CWE-416

Thu, 27 Aug 2026 06:15:00 +0000

Type	Values Removed	Values Added
Metrics		cvssV3_1 `{'score': 9.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}`

Wed, 26 Aug 2026 17:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-416

Wed, 26 Aug 2026 14:45:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: block: stop the timeout timer when releasing a never added disk disk_release() undoes blk_mq_init_allocated_queue() for a disk whose probe failed before add_disk(), but it only calls blk_mq_exit_queue(). Nothing there stops q->timeout, and that timer rolls forward: it stays pending until it next expires, not until the last request completes. So if the driver issued any I/O before adding the disk, the request_queue is freed while still linked into a timer wheel bucket. Commit 6f8191fdf41d ("block: simplify disk shutdown") dropped the blk_cleanup_queue() call that used to stop it. __del_gendisk() and blk_mq_destroy_queue() still do; only the probe failure path lost it. nvme gets there because nvme_update_ns_info() submits Report Zones or FDP io-mgmt-recv on ns->queue before the disk is added, so a later failure - a concurrent reset setting NVME_CTRL_FROZEN, or device_add_disk() failing - lands in put_disk() with the timer armed: BUG: KASAN: slab-use-after-free in detach_if_pending+0x30c/0x340 Write of size 8 at addr ffff888004d71310 by task kworker/u8:2/37 __timer_delete_sync+0x156/0x240 kernel/time/timer.c:1621 blk_sync_queue+0x22/0x40 block/blk-core.c:222 nvme_sync_queues+0x100/0x150 drivers/nvme/host/core.c:5362 nvme_reset_work+0x138/0x930 drivers/nvme/host/pci.c:3264 Allocated by task 34: __blk_mq_alloc_disk+0x33/0x100 block/blk-mq.c:4462 nvme_alloc_ns+0x290/0x3870 drivers/nvme/host/core.c:4146 Freed by task 0: blk_free_queue_rcu+0x3a/0x50 block/blk-core.c:254 rcu_core+0xc10/0x1730 kernel/rcu/tree.c:2857 The queue being synced there is ctrl->admin_q, only a victim sharing a timer wheel bucket with the freed queue's dangling entry; other runs tripped in enqueue_timer(), __run_timers() or blk_mq_timeout_work(). Failing nvme_alloc_ns() with a debug patch makes it deterministic: one leaked timer trips KASAN within seconds, while 1987 patched releases produced no splat. Stop the timer and the queue work items before blk_mq_exit_queue(), like blk_mq_destroy_queue() does. Found by FuzzNvme.
Title		block: stop the timeout timer when releasing a never added disk
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/1a0ae4d502062a2759f2a92d12bdeab3c64c7372 https://git.kernel.org/stable/c/26cb8ebbfaf713c82e142d08828d4d765057633b https://git.kernel.org/stable/c/6ae7364f68e6c7af6b6df4bbb14040b89e5975d0 https://git.kernel.org/stable/c/6f06dbe5012c160e0dba418a5a9cb16c456ad46a https://git.kernel.org/stable/c/93d620519d71dfc6ee64b5baea74f1d85d4439fb https://git.kernel.org/stable/c/bb03b56d1d754908a37a160603be21769da423cf

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-08-26T14:37:43.293Z

Updated: 2026-08-27T05:02:10.391Z

Reserved: 2026-08-26T14:34:25.770Z

Link: CVE-2026-80589

Vulnrichment

No data.

NVD

Status : Received

Published: 2026-08-26T15:17:15.283

Modified: 2026-08-27T06:17:46.553

Link: CVE-2026-80589

Redhat

Severity : Moderate

Publid Date: 2026-08-26T00:00:00Z

Links: CVE-2026-80589 - Bugzilla

OpenCVE Enrichment

Updated: 2026-08-28T19:30:16Z

Weaknesses

CWE-825
Expired Pointer Dereference

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object