CVE-2026-89970
CVE-2026-89970: 1 tracked advisory record across Red Hat. Compare vendor sources and published fix guidance.
Compare the source-linked records below. Ratings and product/version details belong to each advisory; they are not a single CVE-wide score or proof that every listed product is affected. How VulniPulse collects and checks evidence.
Vendor advisory comparison
Red Hat
1 advisory- Advisory severityHigh7.8
High [CVE-2026-89970] Synchronize timeout work during SQ teardown
CVE-2026-89970Source published Source updated
In the Linux kernel, the following vulnerability has been resolved: nvmet-auth: Synchronize timeout work during SQ teardown nvmet_auth_sq_free() cancels auth_expired_work with cancel_delayed_work(). If the work has already started, cancellation does not wait for the callback. Transport teardown can consequently free or reuse the queue containing struct nvmet_sq while nvmet_auth_expired_work() still accesses that SQ. Add a teardown-specific helper that synchronously drains the delayed work before freeing authentication state, and use it from nvmet_sq_destroy(). Keep the non-synchronous helper for in-band authentication state cleanup, where the SQ owner remains alive. A timing issue during the cleanup of a Submission Queue (SQ) can lead to a use-after-free vulnerability. This occurs when a…
- Affected products in this advisory
- Red Hat Enterprise Linux 10
- Red Hat Enterprise Linux 9
- Red Hat package: kernel-rt
- Source-reported affected versions
- Affected-version details not available in this record.
- Source-reported fixed versions
- No fixed-version detail extracted. This does not mean no fix exists.
- Mitigation guidance
- Prevent the NVMe target kernel module from loading if the host is not intended to operate as an NVMe over Fabrics target server. 1. Create a modprobe configuration file to disable the module: # echo "install nvmet /bin/true" > /etc/modprobe.d/disable-nvmet.conf 2. If the module is already loaded, remove it: # modprobe -r nvmet Caveats: This configuration prevents the host from functioning as an NVMe-oF target. It does not disrupt normal NVMe host/initiator storage capabilities. Warning: If the nvmet module is currently in use, removing it or restarting the host will terminate existing NVMe target storage connections and disrupt attached clients.
Android app · Google Play
Monitor future Red Hat CVEs from your phone.
Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 34 official vendor sources and 160+ reviewed platform categories.