CVE-2026-80589 in Linux
Summary
by MITRE • 08/26/2026
In the Linux kernel, the following vulnerability has been resolved:
block: stop the timeout timer when releasing a never added disk
disk_release() undoes blk_mq_init_allocated_queue() for a disk whose probe failed before add_disk(), but it only calls blk_mq_exit_queue(). Nothing there stops q->timeout, and that timer rolls forward: it stays pending until it next expires, not until the last request completes. So if the driver issued any I/O before adding the disk, the request_queue is freed while still linked into a timer wheel bucket.
Commit 6f8191fdf41d ("block: simplify disk shutdown") dropped the blk_cleanup_queue() call that used to stop it. __del_gendisk() and blk_mq_destroy_queue() still do; only the probe failure path lost it.
nvme gets there because nvme_update_ns_info() submits Report Zones or FDP io-mgmt-recv on ns->queue before the disk is added, so a later failure - a concurrent reset setting NVME_CTRL_FROZEN, or device_add_disk() failing - lands in put_disk() with the timer armed:
BUG: KASAN: slab-use-after-free in detach_if_pending+0x30c/0x340 Write of size 8 at addr ffff888004d71310 by task kworker/u8:2/37 __timer_delete_sync+0x156/0x240 kernel/time/timer.c:1621 blk_sync_queue+0x22/0x40 block/blk-core.c:222 nvme_sync_queues+0x100/0x150 drivers/nvme/host/core.c:5362 nvme_reset_work+0x138/0x930 drivers/nvme/host/pci.c:3264
Allocated by task 34: __blk_mq_alloc_disk+0x33/0x100 block/blk-mq.c:4462 nvme_alloc_ns+0x290/0x3870 drivers/nvme/host/core.c:4146
Freed by task 0: blk_free_queue_rcu+0x3a/0x50 block/blk-core.c:254 rcu_core+0xc10/0x1730 kernel/rcu/tree.c:2857
The queue being synced there is ctrl->admin_q, only a victim sharing a timer wheel bucket with the freed queue's dangling entry; other runs tripped in enqueue_timer(), __run_timers() or blk_mq_timeout_work(). Failing nvme_alloc_ns() with a debug patch makes it deterministic: one leaked timer trips KASAN within seconds, while 1987 patched releases produced no splat.
Stop the timer and the queue work items before blk_mq_exit_queue(), like blk_mq_destroy_queue() does.
Found by FuzzNvme.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 08/26/2026
The Linux kernel block layer contains a critical use-after-free vulnerability that arises during disk initialization failure paths, specifically when a device probe fails after the request queue has been allocated but before the disk is registered with the system. This flaw was introduced in commit 6f8191fdf41d which simplified disk shutdown procedures by removing certain cleanup calls from specific code paths. The core issue lies in the disk_release function, which handles the deallocation of a gendisk structure when initialization fails. While this function correctly undoes most allocations performed during probe preparation, it neglects to stop the timeout timer associated with the request queue before exiting the multi-queue block layer context. Consequently, if any I/O operations were submitted prior to adding the disk, the underlying request_queue is freed while its timeout timer remains active and linked within a kernel timer wheel bucket. This creates a dangling pointer scenario where subsequent timer expirations attempt to access memory that has already been released back to the slab allocator.
The operational impact of this vulnerability is severe, manifesting as Kernel Address Sanitizer (KASAN) errors indicating slab-use-after-free conditions. The primary affected subsystem is NVMe storage drivers, which submit management commands such as Report Zones or FDP io-mgmt-recv on the namespace queue before the disk structure is fully added to the system. If a subsequent event occurs that causes initialization to fail, such as a concurrent controller reset setting the FROZEN flag or device_add_disk returning an error, the cleanup routine triggers put_disk and subsequently releases the memory associated with the request_queue. However, because the timeout timer was not stopped, it continues to fire asynchronously. When these timers expire, they invoke callback functions like detach_if_pending or enqueue_timer that reference the now-freed queue structure. This leads to kernel panics, system instability, or potential exploitation by local attackers who can trigger device probe failures and race conditions to corrupt kernel memory state.
From a technical classification perspective, this vulnerability aligns with CWE-416 Use After Free, as it involves accessing memory after it has been freed due to improper resource management during error handling paths. It also relates to CWE-362 Concurrent Execution Using Shared Resource with Improper Synchronization, given that the timer expiration occurs asynchronously and races against the deallocation of the queue structure in a different execution context. In terms of MITRE ATT&CK mapping, this represents an exploitation technique involving memory corruption via use-after-free, which can potentially lead to arbitrary code execution or denial of service depending on how the freed memory is reallocated by other kernel subsystems before the dangling timer callback executes.
The resolution involves modifying the disk release logic in the block layer to explicitly stop the timeout timer and cancel queue work items prior to calling blk_mq_exit_queue. This ensures that all asynchronous operations associated with the request queue are synchronized and terminated before the memory is reclaimed, mirroring the safe cleanup sequence already present in other shutdown paths like __del_gendisk and blk_mq_destroy_queue. To mitigate this risk until patches are applied, administrators should ensure systems are updated to kernel versions containing the fix for commit 6f8191fdf41d regression. Additionally, monitoring system logs for KASAN splats or NVMe controller reset events can help identify affected instances in production environments where probe failures might occur due to hardware issues or driver bugs.