CVE-2026-80589: block: stop the timeout timer when releasing a never added disk
block: stop the timeout timer when releasing a never added disk
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 6.6.157.1-1 - Upgrade
Upgrade
ubuntu/linux-nvidia-tegrato a version that resolves this vulnerability.Fixed in 6.8.0-1036.39 - Compensating control
In the probe-failure cleanup path for a never-added disk, stop the request queue timeout timer and queue work items before calling blk_mq_exit_queue(), as blk_mq_destroy_queue() does.
Event History
Frequently Asked Questions
Which systems are most likely to encounter this issue?
Systems using affected Linux kernel block-layer code can encounter it when a disk probe fails before the disk is added, after I/O has already been submitted on that disk's request queue. The described NVMe path can submit Report Zones or FDP I/O-management receive commands before the namespace disk is added.
What conditions are needed to trigger the use-after-free?
The driver must issue I/O before add_disk(), then a later probe-stage failure must release the disk while the queue timeout timer remains armed. Examples given include a concurrent NVMe reset setting NVME_CTRL_FROZEN or device_add_disk() failing.
How might this appear in diagnostics?
The reported symptom is a KASAN slab-use-after-free involving timer removal, such as detach_if_pending or __timer_delete_sync, after the request queue has been freed while still linked in a timer wheel bucket.