High [CVE-2026-89970] Synchronize timeout work during SQ teardown
This high-severity Red Hat Linux advisory covers CVE-2026-89970 affecting Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 9, Red Hat package: kernel-rt.
Aggregated and source-linked by VulniPulse. Data sources, validation and limitations.
VulniPulse record published Record updated
Android app · Google Play
Monitor future Red Hat Linux CVEs from your phone.
Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 34 official vendor sources and 160+ reviewed platform categories.
Summary
In the Linux kernel, the following vulnerability has been resolved: nvmet-auth: Synchronize timeout work during SQ teardown nvmet_auth_sq_free() cancels auth_expired_work with cancel_delayed_work(). If the work has already started, cancellation does not wait for the callback.
Transport teardown can consequently free or reuse the queue containing struct nvmet_sq while nvmet_auth_expired_work() still accesses that SQ. Add a teardown-specific helper that synchronously drains the delayed work before freeing authentication state, and use it from nvmet_sq_destroy().
Keep the non-synchronous helper for in-band authentication state cleanup, where the SQ owner remains alive. A timing issue during the cleanup of a Submission Queue (SQ) can lead to a use-after-free vulnerability.
This occurs when a delayed authentication task attempts to access memory that has already been released or repurposed. An attacker could potentially exploit this to cause a system crash (denial of service) or other memory corruption impacts.
Red Hat severity: Important — CVSS 7.8 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Weakness: CWE-825.
Affected Red Hat products: Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 9. Red Hat does not currently list a fixing RHSA for this CVE.
Affected products named by the advisory: Red Hat package: kernel-rt.
Affected versions
No affected-version range was extracted from the source record. The vendor advisory is authoritative — check it before change work.
Official advisory · high-confidence parse· fetched 1 hour ago·verify at source
Fixed versions
No fixed release is recorded yet. That does not prove no patch exists — confirm against the vendor advisory.
Official advisory · high-confidence parse· fetched 1 hour ago·verify at source
Mitigation checklist
- Prevent the NVMe target kernel module from loading if the host is not intended to operate as an NVMe over Fabrics target server. 1. Create a modprobe configuration file to disable the module: # echo "install nvmet /bin/true" > /etc/modprobe.d/disable-nvmet.conf 2. If the module is already loaded, remove it: # modprobe -r nvmet Caveats: This configuration prevents the host from functioning as an NVMe-oF target. It does not disrupt normal NVMe host/initiator storage capabilities. Warning: If the nvmet module is currently in use, removing it or restarting the host will terminate existing NVMe target storage connections and disrupt attached clients.
Official advisory · high-confidence parse· fetched 1 hour ago·verify at source
Discussion(0)
No comments yet. Share field notes, upgrade gotchas, or questions — verify against the vendor advisory before acting on community advice.
Sign in to join the discussion.