EUVD-2026-80570
GHSA-p375-rp8x-7v2g
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
NVMe-oF fabric is network-reachable (AV:N) and auth is the exploited surface (PR:N), but it is a narrow timing race (AC:H) yielding a UAF crash (A:H) with no data disclosure (C:N).
Primary rating from Vendor (Linux).
CVSS VectorVendor: Linux
Lifecycle Timeline
7DescriptionCVE.org
In the Linux kernel, the following vulnerability has been resolved:
nvmet-auth: Synchronize timeout work during SQ teardown
nvmet_auth_sq_free() cancels auth_expired_work with cancel_delayed_work(). If the work has already started, cancellation does not wait for the callback. Transport teardown can consequently free or reuse the queue containing struct nvmet_sq while nvmet_auth_expired_work() still accesses that SQ.
Add a teardown-specific helper that synchronously drains the delayed work before freeing authentication state, and use it from nvmet_sq_destroy(). Keep the non-synchronous helper for in-band authentication state cleanup, where the SQ owner remains alive.
AnalysisAI
A race condition in the Linux kernel's NVMe-over-Fabrics target authentication code (nvmet-auth) can leave a queue structure (struct nvmet_sq) freed or reused while the auth_expired_work delayed-work callback is still executing, potentially crashing or corrupting the memory of the target host. Exposure is limited to Linux systems acting as NVMe-oF targets (nvmet) with in-band DH-HMAC-CHAP authentication enabled: an attacker must be positioned on the NVMe-oF fabric (TCP or RDMA), be able to open and tear down authenticated sessions, and win a narrow, non-deterministic timing window during transport teardown, which is why our independent assessment rates the issue well below the vendor's 9.8 (AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H) and finds no confidentiality impact despite the 'Information Disclosure' tag. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitable only on Linux hosts acting as an NVMe-over-Fabrics target (nvmet) with in-band authentication (DH-HMAC-CHAP) enabled, because the vulnerable auth_expired_work delayed work exists only in that configuration. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The vendor CVSS of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) materially overstates real-world risk for this issue. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Vendor-released patches are available: stable kernels 6.1.188, 6.6.157, 6.12.110, 6.18.51, 7.2.5 and 7.3-rc2 carry the fix (upstream stable commits c3c126a6142a1335bc8c34a5607c39cf01daf295, eaa948c0e19b1bb2d93262207bca0c3d19cc3406, c17c87bde6d6f5252a6a6f0a94b2430164aa28d5, eb4f9127a2b8a152743f1ee597627e2f69cb54fe, 664022fa1c93f4eba09ef5ee02411b9709dd7a93 and 7555ddd60af72df2862dd8f9b730a9848577edda, referenced from https://git.kernel.org/stable/c/664022fa1c93f4eba09ef5ee02411b9709dd7a93 and the parallel per-branch URLs listed in the advisory data, with NVD detail at https://nvd.nist.gov/vuln/detail/CVE-2026-89970), so the primary action is to update the kernel to the matching fixed release for your distribution and reboot, since kernel fixes cannot be applied live without kpatch-style livepatching support. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory every Linux host acting as an NVMe-oF target (nvmet) with in-band DH-HMAC-CHAP authentication enabled, confirm which kernel builds they run, and restrict TCP/RDMA fabric reachability to known initiator addresses only so the required attacker position is not available to untrusted segments. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today