CVE-2026-89970: nvmet-auth: Synchronize timeout work during SQ teardown
In the Linux kernel, the following vulnerability has been resolved:
nvmet-auth: Synchronize timeout work during SQ teardown
nvmetauthsqfree() cancels authexpiredwork with canceldelayedwork(). If the work has already started, cancellation does not wait for the callback. Transport teardown can consequently free or reuse the queue containing struct nvmetsq while nvmetauthexpiredwork() still accesses that SQ.
Add a teardown-specific helper that synchronously drains the delayed work before freeing authentication state, and use it from nvmetsqdestroy(). Keep the non-synchronous helper for in-band authentication state cleanup, where the SQ owner remains alive.
Affected Software
Event History
Frequently Asked Questions
When can this race occur?
It can occur during transport teardown when the submission queue is destroyed while the delayed authentication-expiry work has already begun running. In that case, ordinary delayed-work cancellation does not wait for the callback to finish.
What is the impact of the affected teardown path?
The queue and its authentication state can be freed or reused while nvmet_auth_expired_work() still accesses the queue. This creates a use-after-free or reuse race involving struct nvmet_sq.
What mitigation is described if the fix is not yet applied?
The provided data does not describe an operational workaround. The resolved approach is to synchronously drain the delayed authentication-expiry work during submission-queue teardown before freeing authentication state.