CVE-2026-89972: nvme: add missing SRCU grace period in error path
In the Linux kernel, the following vulnerability has been resolved:
nvme: add missing SRCU grace period in error path
nvmeallocns() error path at outunlinkns removes ns from the namespace head siblings list with listdelrcu(&ns->siblings) but does not wait for SRCU readers before freeing the namespace struct. Multipath code iterates the head->list under srcureadlock() in nvmefindpath() and nvmempathrevalidatepaths(), so a concurrent reader can still hold a reference to ns when kfree(ns) runs.
The normal removal path in nvmensremove() correctly calls synchronizesrcu(&ns->head->srcu) after listdelrcu() to wait for in-progress readers. Add the same grace period in the error path.
Affected Software
Event History
Frequently Asked Questions
What runtime conditions are required for the unsafe free to occur?
The namespace allocation error path must remove a namespace while NVMe multipath code is concurrently iterating the namespace list under an SRCU read lock. Without the SRCU grace period, the namespace structure can be freed before those in-progress readers finish.
Does the normal namespace removal path have the same issue?
No. The normal nvme_ns_remove() path already waits for SRCU readers with synchronize_srcu() after removing the namespace from the RCU-protected list.
What is the available remediation?
Apply a Linux kernel update containing the fix that adds the SRCU grace period to the nvme_alloc_ns() error path. The provided stable-kernel references identify commits carrying the correction.