CVE-2026-80589: block: stop the timeout timer when releasing a never added disk
In the Linux kernel, the following vulnerability has been resolved:
block: stop the timeout timer when releasing a never added disk
diskrelease() undoes blkmqinitallocatedqueue() for a disk whose probe failed before adddisk(), but it only calls blkmqexitqueue(). Nothing there stops q->timeout, and that timer rolls forward: it stays pending until it next expires, not until the last request completes. So if the driver issued any I/O before adding the disk, the requestqueue is freed while still linked into a timer wheel bucket.
Commit 6f8191fdf41d ("block: simplify disk shutdown") dropped the blkcleanupqueue() call that used to stop it. delgendisk() and blkmqdestroyqueue() still do; only the probe failure path lost it.
nvme gets there because nvmeupdatensinfo() submits Report Zones or FDP io-mgmt-recv on ns->queue before the disk is added, so a later failure - a concurrent reset setting NVMECTRLFROZEN, or deviceadddisk() failing - lands in putdisk() with the timer armed:
BUG: KASAN: slab-use-after-free in detachifpending+0x30c/0x340 Write of size 8 at addr ffff888004d71310 by task kworker/u8:2/37 timerdeletesync+0x156/0x240 kernel/time/timer.c:1621 blksyncqueue+0x22/0x40 block/blk-core.c:222 nvmesyncqueues+0x100/0x150 drivers/nvme/host/core.c:5362 nvmeresetwork+0x138/0x930 drivers/nvme/host/pci.c:3264
Allocated by task 34: blkmqallocdisk+0x33/0x100 block/blk-mq.c:4462 nvmeallocns+0x290/0x3870 drivers/nvme/host/core.c:4146
Freed by task 0: blkfreequeuercu+0x3a/0x50 block/blk-core.c:254 rcucore+0xc10/0x1730 kernel/rcu/tree.c:2857
The queue being synced there is ctrl->adminq, only a victim sharing a timer wheel bucket with the freed queue's dangling entry; other runs tripped in enqueuetimer(), runtimers() or blkmqtimeoutwork(). Failing nvmeallocns() with a debug patch makes it deterministic: one leaked timer trips KASAN within seconds, while 1987 patched releases produced no splat.
Stop the timer and the queue work items before blkmqexitqueue(), like blkmqdestroyqueue() does.
Found by FuzzNvme.
Affected Software
Event History
Frequently Asked Questions
Which systems are most likely to encounter this issue?
Systems using affected Linux kernel block-layer code can encounter it when a disk probe fails before the disk is added, after I/O has already been submitted on that disk's request queue. The described NVMe path can submit Report Zones or FDP I/O-management receive commands before the namespace disk is added.
What conditions are needed to trigger the use-after-free?
The driver must issue I/O before add_disk(), then a later probe-stage failure must release the disk while the queue timeout timer remains armed. Examples given include a concurrent NVMe reset setting NVME_CTRL_FROZEN or device_add_disk() failing.
How might this appear in diagnostics?
The reported symptom is a KASAN slab-use-after-free involving timer removal, such as detach_if_pending or __timer_delete_sync, after the request queue has been freed while still linked in a timer wheel bucket.