CVE-2026-80589: Linux Kernel Use-After-Free Vulnerability

CVE-2026-80589 Overview

CVE-2026-80589 is a use-after-free vulnerability in the Linux kernel block subsystem. The flaw occurs when disk_release() unwinds a disk whose probe failed before add_disk() completed. The cleanup path calls blk_mq_exit_queue() but never stops the queue's timeout timer (q->timeout), leaving a dangling timer wheel entry that references freed memory.

The NVMe driver reaches this state through nvme_update_ns_info(), which submits Report Zones or FDP io-mgmt-recv commands on ns->queue before the disk is registered. A subsequent probe failure or concurrent controller reset triggers the release path with the timer still armed.

Critical Impact
Attackers who can trigger NVMe probe failures or controller resets can cause kernel memory corruption, leading to potential privilege escalation or system compromise.

Affected Products

Linux kernel block subsystem (block/blk-core.c, block/blk-mq.c)
NVMe host driver (drivers/nvme/host/core.c, drivers/nvme/host/pci.c)
Any block driver that issues I/O between blk_mq_init_allocated_queue() and add_disk()

Discovery Timeline

2026-08-26 - CVE-2026-80589 published to NVD
2026-08-27 - Last updated in NVD database

The issue was found by the FuzzNvme fuzzing framework, according to the upstream commit message.

Technical Details for CVE-2026-80589

Vulnerability Analysis

The vulnerability is a kernel use-after-free ([CWE-416]) in the block layer disk release path. When a driver allocates a request queue via __blk_mq_alloc_disk() and issues I/O before calling add_disk(), the queue's timeout timer becomes armed. If probe then fails, disk_release() invokes blk_mq_exit_queue() without first stopping q->timeout.

The timer remains linked in a timer wheel bucket after blk_free_queue_rcu() frees the request_queue. Later timer wheel operations dereference the freed memory. KASAN traces show the fault triggering inside detach_if_pending(), enqueue_timer(), __run_timers(), or blk_mq_timeout_work().

In NVMe, the trigger is reliable: nvme_update_ns_info() submits admin-style I/O on ns->queue prior to disk registration. A concurrent reset that sets NVME_CTRL_FROZEN, or a failing device_add_disk(), lands the queue in put_disk() with the timer still pending.

Root Cause

Commit 6f8191fdf41d ("block: simplify disk shutdown") removed the blk_cleanup_queue() call that previously stopped the timer. The normal shutdown paths, __del_gendisk() and blk_mq_destroy_queue(), retained equivalent cleanup logic. The probe-failure path did not, leaving disk_release() incomplete for queues that had received I/O but were never added.

Attack Vector

Exploitation requires the ability to cause NVMe probe failures or trigger controller resets while namespace initialization is in flight. A local attacker with access to hot-plug operations, or an adversary able to induce device errors, can race probe teardown against timer expiry. The freed request_queue object sharing a timer bucket with unrelated queues produces cross-queue corruption during blk_sync_queue() and __timer_delete_sync(). Successful memory corruption in kernel space can be escalated to arbitrary code execution.

The upstream fix stops the timer and drains queue work items before blk_mq_exit_queue(), mirroring the behavior of blk_mq_destroy_queue(). Refer to the upstream kernel commits for the patch content.

Detection Methods for CVE-2026-80589

Indicators of Compromise

KASAN reports referencing detach_if_pending, enqueue_timer, __run_timers, or blk_mq_timeout_work with slab-use-after-free on request_queue objects
Kernel panics or oopses during nvme_reset_work or nvme_sync_queues calls
Unexpected NVMe controller resets correlated with namespace probe failures

Detection Strategies

Enable KASAN and lockdep on test kernels to surface the use-after-free during NVMe probe fuzzing
Collect dmesg output and kernel crash dumps from production hosts running unpatched kernels, and grep for blk_sync_queue in stack traces
Correlate NVMe error events with subsequent kernel warnings using centralized log aggregation

Monitoring Recommendations

Forward kernel logs to a central SIEM and alert on KASAN/UBSAN entries referencing block or NVMe symbols
Track NVMe controller reset frequency; sustained increases may indicate probe instability that exposes this race
Monitor unplanned host reboots on storage-heavy nodes running affected kernel versions

How to Mitigate CVE-2026-80589

Immediate Actions Required

Inventory Linux hosts running kernels built after commit 6f8191fdf41d and identify systems using NVMe storage
Apply the upstream stable kernel updates that stop q->timeout before blk_mq_exit_queue() in disk_release()
Restart affected hosts after patching to ensure the fixed kernel is loaded

Patch Information

Upstream fixes are available across multiple stable branches. Reference the following commits:

Consume the fix through your distribution's stable kernel update channel.

Workarounds

No supported runtime workaround exists; the fix must be applied at the kernel level
Reduce exposure by limiting untrusted access to NVMe hot-plug and reset operations
Where feasible, avoid concurrent NVMe controller resets during namespace initialization on unpatched hosts

bash

# Verify running kernel version and check for patch presence
uname -r
rpm -q --changelog kernel | grep -i "disk_release\|blk_mq_exit_queue" | head
# Debian/Ubuntu equivalent
apt changelog linux-image-$(uname -r) | grep -i "disk_release\|blk_mq_exit_queue"