CVE-2026-89970: Linux Kernel Race Condition Vulnerability

CVE-2026-89970 Overview

CVE-2026-89970 is a use-after-free vulnerability in the Linux kernel's NVMe over Fabrics target authentication (nvmet-auth) subsystem. The flaw resides in nvmet_auth_sq_free(), which cancels auth_expired_work using cancel_delayed_work(). When the delayed work has already started executing, cancellation returns without waiting for the callback to complete. Transport teardown can then free or reuse the queue holding struct nvmet_sq while nvmet_auth_expired_work() continues to access it. The race condition affects Linux kernel NVMe-oF target deployments exposing authenticated NVMe fabrics endpoints.

Critical Impact
Remote attackers reaching an NVMe-oF target with authentication enabled can trigger a use-after-free on the submission queue, resulting in kernel memory corruption, denial of service, or potential code execution.

Affected Products

Linux kernel with CONFIG_NVME_TARGET_AUTH enabled
NVMe over Fabrics target deployments using in-band authentication
Storage systems exporting NVMe-oF namespaces over TCP or RDMA transports

Discovery Timeline

2026-09-16 - CVE-2026-89970 published to NVD
2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-89970

Vulnerability Analysis

The defect is a race condition between the NVMe target authentication timeout handler and submission queue (SQ) teardown. nvmet_auth_sq_free() invokes cancel_delayed_work() to stop the pending auth_expired_work handler. This API does not synchronize with an in-flight callback. If nvmet_auth_expired_work() is already running on another CPU, the teardown path proceeds and releases the struct nvmet_sq while the work handler continues to dereference it.

The result is a use-after-free within kernel context. Depending on allocator state and timing, exploitation can corrupt adjacent slab objects, panic the kernel, or enable controlled overwrites of freed queue memory. Because NVMe-oF targets are commonly reachable over the network, the attack surface extends beyond local users.

Root Cause

The root cause is the use of cancel_delayed_work() instead of cancel_delayed_work_sync() in the authentication teardown path. The non-synchronous variant does not guarantee that a running work callback has completed before the caller proceeds. The patch introduces a teardown-specific helper that synchronously drains the delayed work before freeing authentication state, and calls it from nvmet_sq_destroy(). The original non-synchronous helper is retained for in-band authentication state cleanup where the SQ owner remains alive.

Attack Vector

An attacker who can initiate NVMe-oF sessions with authentication against a vulnerable target can trigger the race by repeatedly establishing and tearing down connections while authentication timers are pending. The network-reachable, unauthenticated nature of the attack surface, combined with predictable teardown flows, makes the race window practical to hit under realistic conditions. See the upstream fix commits for the corrected teardown ordering, including Kernel Git Commit c17c87bd and Kernel Git Commit eb4f9127.

Detection Methods for CVE-2026-89970

Indicators of Compromise

Unexpected kernel oops or panic traces referencing nvmet_auth_expired_work or nvmet_sq_destroy
KASAN reports flagging use-after-free reads or writes in nvmet_auth code paths
Repeated NVMe-oF connect/disconnect sequences from a single remote initiator preceding kernel instability

Detection Strategies

Enable KASAN on test and staging kernels to surface use-after-free conditions in nvmet subsystems before production exposure
Correlate dmesg and journald kernel logs for stack traces containing nvmet_auth_sq_free or delayed-work symbols
Inventory hosts loading the nvmet and nvmet-tcp or nvmet-rdma modules to scope exposure

Monitoring Recommendations

Alert on kernel crash and reboot events on storage targets running NVMe-oF services
Monitor NVMe-oF listener ports (default TCP 4420) for abnormal connection churn from untrusted sources
Track kernel package versions across the fleet and flag hosts still running pre-patch builds

How to Mitigate CVE-2026-89970

Immediate Actions Required

Apply the upstream kernel patches referenced in the NVD entry and rebuild or upgrade to a fixed stable kernel
Restrict network access to NVMe-oF target ports to trusted storage networks only
If patching is delayed, disable NVMe target authentication or unload the nvmet module on non-essential hosts

Patch Information

The fix adds a teardown-specific helper that calls cancel_delayed_work_sync() to drain auth_expired_work before freeing authentication state, and invokes it from nvmet_sq_destroy(). Corrected commits are available at Kernel Git Commit 664022fa, Kernel Git Commit 7555ddd6, Kernel Git Commit c3c126a6, and Kernel Git Commit eaa948c0.

Workarounds

Segment NVMe-oF traffic onto isolated VLANs or private storage fabrics inaccessible to general clients
Enforce firewall rules limiting NVMe-oF listener access to known initiator IP addresses
Where authentication is not strictly required, disable in-band authentication until the patched kernel is deployed

bash

# Verify running kernel and nvmet module status
uname -r
lsmod | grep -E 'nvmet|nvmet_tcp|nvmet_rdma'

# Restrict NVMe-oF TCP listener to trusted storage subnet
sudo nft add rule inet filter input tcp dport 4420 ip saddr != 10.20.0.0/24 drop

# Unload nvmet modules on hosts that do not require NVMe-oF target services
sudo modprobe -r nvmet_tcp nvmet_rdma nvmet