EUVD-2026-80572
GHSA-cjx2-56hv-4vc4
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Internal kernel race triggered locally via NVMe activity (AV:L, PR:L), timing-dependent rare error path (AC:H); UAF yields memory corruption/crash so A:H with minor I:L and no confidentiality (C:N).
Primary rating from Vendor (Linux).
CVSS VectorVendor: Linux
Lifecycle Timeline
7DescriptionCVE.org
In the Linux kernel, the following vulnerability has been resolved:
nvme: add missing SRCU grace period in error path
nvme_alloc_ns() error path at out_unlink_ns removes ns from the namespace head siblings list with list_del_rcu(&ns->siblings) but does not wait for SRCU readers before freeing the namespace struct. Multipath code iterates the head->list under srcu_read_lock() in nvme_find_path() and nvme_mpath_revalidate_paths(), so a concurrent reader can still hold a reference to ns when kfree(ns) runs.
The normal removal path in nvme_ns_remove() correctly calls synchronize_srcu(&ns->head->srcu) after list_del_rcu() to wait for in-progress readers. Add the same grace period in the error path.
AnalysisAI
A use-after-free race in the Linux kernel NVMe driver allows a local user with basic privileges to crash the kernel (denial of service) by forcing the namespace-allocation error path in nvme_alloc_ns to run while a concurrent thread is still iterating the multipath sibling list under SRCU. Exposure is limited to hosts running the NVMe subsystem with native multipath configured, that actually hit a namespace allocation failure, and within a narrow timing window; the impact assessed is kernel memory corruption leading to a crash, with no confirmed path to data disclosure or code execution. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires a Linux host running the NVMe subsystem with multipath active (head->list traversed under SRCU in nvme_find_path/nvme_mpath_revalidate_paths), AND the namespace-allocation error path (out_unlink_ns in nvme_alloc_ns) must actually be hit - i.e. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The vendor CVSS of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) is a severe over-score that does not match the actual defect. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Vendor-released patch: Linux 6.18.51, 7.2.5 and 7.3-rc2 (upstream commits d663944dbad81bb0e3635d7090db4713e6300858, 76023560d60f10b4f808941163aa2975f1631683 and ef248d5de4469fb6bbaf8dbe0c4c47800080d648, linked from the CVE record); upgrading to any kernel at or above those versions is the definitive fix because it adds the missing synchronize_srcu() grace period in the out_unlink_ns error path. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all Linux hosts running NVMe native multipath and confirm kernel versions; within 7 days, apply the patch available per vendor advisory (check your distribution's security advisory for the specific kernel version) that addresses CVE-2026-89972, prioritizing production storage nodes; within 30 days, validate patch deployment across all affected systems, monitor kernel logs for use-after-free crashes, and review multipath configurations to reduce exposure.
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today