From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id A568C4483B9 for ; Wed, 26 Aug 2026 14:41:17 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1787755281; cv=none; b=TcDEuo9X/b94m1D+cnNrlZWYiA76nSvBx5kW/VmPEQz7vGskLXmkP0SmwZnSsLyRLhKMKUl1YPJDO9QjmJ1Sk5mekM5LXA+y1w2iZ4IIrNHgsvrFZRpyko1C2erWsNAGPqHFOM7NNbca1Agun6gvOh4ia2ny9OU9jcAd6hc9qo8= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1787755281; c=relaxed/simple; bh=hjjfvUtsc4yOmoj+MkW1CoZG/d/JQqemjLU+kKvrhWk=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=awhF4Rq86uN8QgKA4SpRd12GO8ybBUojsgPoQYoCQHU/QpZsH85NBK0L8/crZ8FG4KkZ2eJAqaE85+bB7Qc0eznlgpUoYhT0UVJvQ4ME4kV8pKm5mGcrJAvpCXf76lUN/79jeLf6x1LPdEdgwFqTc29YmS8b0Vkp2PM3NP0XXkw= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=Tjf40XkP; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b="Tjf40XkP" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 861C41F00A3A; Wed, 26 Aug 2026 14:41:14 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linuxfoundation.org; s=korg; t=1787755275; bh=o25T6lfQh7Z5FuK+YozbFwHswEnoLrNkovFjF2acnyI=; h=From:To:Cc:Subject:Date:Reply-To; b=Tjf40XkPBxSf6D4PK47wQz8XYThXnw4d890icYn53bzzqAEkw2LHsD+sCBnzUCsEw ieq0cky2ue68ahZf966Oz1kaBVO5L//GtjVh6Z+d56QzK6rseNcuQPdO2919YriIej uNiWJBAigGDABDHwHvcp8E+/kbOmphAnpY3e9u14= From: Greg Kroah-Hartman To: linux-cve-announce@vger.kernel.org Cc: Greg Kroah-Hartman Subject: CVE-2026-80589: block: stop the timeout timer when releasing a never added disk Date: Wed, 26 Aug 2026 16:38:25 +0200 Message-ID: <2026082617-CVE-2026-80589-81b6@gregkh> X-Mailer: git-send-email 2.55.0 Reply-To: , Precedence: bulk X-Mailing-List: linux-cve-announce@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 X-Developer-Signature: v=1; a=openpgp-sha256; l=4791; i=gregkh@linuxfoundation.org; h=from:subject:message-id; bh=gnoVESpWfv8kphQS63G9NR7EXm3DzH/HtyW+hB9D1KM=; b=owGbwMvMwCRo6H6F97bub03G02pJDFl9v2TvPpnwKEx5+YTDHxfGtDTqH3D/0Kfpkbfxw+K57 HNCFnrwdsSyMAgyMciKKbJ82cZzdH/FIUUvQ9vTMHNYmUCGMHBxCsBENuYwzM/Wbit5k9jy7sQZ F6vIG18MJyvuOcUwz2L+trv5pzIVmpaIP3W7tvH1Ux9NAQA= X-Developer-Key: i=gregkh@linuxfoundation.org; a=openpgp; fpr=F4B60CC5BF78C2214A313DCB3147D40DDB2DFB29 Content-Transfer-Encoding: 8bit From: Greg Kroah-Hartman Description =========== In the Linux kernel, the following vulnerability has been resolved: block: stop the timeout timer when releasing a never added disk disk_release() undoes blk_mq_init_allocated_queue() for a disk whose probe failed before add_disk(), but it only calls blk_mq_exit_queue(). Nothing there stops q->timeout, and that timer rolls forward: it stays pending until it next expires, not until the last request completes. So if the driver issued any I/O before adding the disk, the request_queue is freed while still linked into a timer wheel bucket. Commit 6f8191fdf41d ("block: simplify disk shutdown") dropped the blk_cleanup_queue() call that used to stop it. __del_gendisk() and blk_mq_destroy_queue() still do; only the probe failure path lost it. nvme gets there because nvme_update_ns_info() submits Report Zones or FDP io-mgmt-recv on ns->queue before the disk is added, so a later failure - a concurrent reset setting NVME_CTRL_FROZEN, or device_add_disk() failing - lands in put_disk() with the timer armed: BUG: KASAN: slab-use-after-free in detach_if_pending+0x30c/0x340 Write of size 8 at addr ffff888004d71310 by task kworker/u8:2/37 __timer_delete_sync+0x156/0x240 kernel/time/timer.c:1621 blk_sync_queue+0x22/0x40 block/blk-core.c:222 nvme_sync_queues+0x100/0x150 drivers/nvme/host/core.c:5362 nvme_reset_work+0x138/0x930 drivers/nvme/host/pci.c:3264 Allocated by task 34: __blk_mq_alloc_disk+0x33/0x100 block/blk-mq.c:4462 nvme_alloc_ns+0x290/0x3870 drivers/nvme/host/core.c:4146 Freed by task 0: blk_free_queue_rcu+0x3a/0x50 block/blk-core.c:254 rcu_core+0xc10/0x1730 kernel/rcu/tree.c:2857 The queue being synced there is ctrl->admin_q, only a victim sharing a timer wheel bucket with the freed queue's dangling entry; other runs tripped in enqueue_timer(), __run_timers() or blk_mq_timeout_work(). Failing nvme_alloc_ns() with a debug patch makes it deterministic: one leaked timer trips KASAN within seconds, while 1987 patched releases produced no splat. Stop the timer and the queue work items before blk_mq_exit_queue(), like blk_mq_destroy_queue() does. Found by FuzzNvme. The Linux kernel CVE team has assigned CVE-2026-80589 to this issue. Affected and fixed versions =========================== Issue introduced in 6.0 with commit 6f8191fdf41d3a53cc1d63fe2234e812c55a0092 and fixed in 6.1.184 with commit 6ae7364f68e6c7af6b6df4bbb14040b89e5975d0 Issue introduced in 6.0 with commit 6f8191fdf41d3a53cc1d63fe2234e812c55a0092 and fixed in 6.6.153 with commit 6f06dbe5012c160e0dba418a5a9cb16c456ad46a Issue introduced in 6.0 with commit 6f8191fdf41d3a53cc1d63fe2234e812c55a0092 and fixed in 6.12.105 with commit 1a0ae4d502062a2759f2a92d12bdeab3c64c7372 Issue introduced in 6.0 with commit 6f8191fdf41d3a53cc1d63fe2234e812c55a0092 and fixed in 6.18.46 with commit bb03b56d1d754908a37a160603be21769da423cf Issue introduced in 6.0 with commit 6f8191fdf41d3a53cc1d63fe2234e812c55a0092 and fixed in 7.1.10 with commit 93d620519d71dfc6ee64b5baea74f1d85d4439fb Issue introduced in 6.0 with commit 6f8191fdf41d3a53cc1d63fe2234e812c55a0092 and fixed in 7.2 with commit 26cb8ebbfaf713c82e142d08828d4d765057633b Issue introduced in 5.19.12 with commit d27b66257db183fe11c10f31246ae965adb005d3 Please see https://www.kernel.org for a full list of currently supported kernel versions by the kernel community. Unaffected versions might change over time as fixes are backported to older supported kernel versions. The official CVE entry at https://cve.org/CVERecord/?id=CVE-2026-80589 will be updated if fixes are backported, please check that for the most up to date information about this issue. Affected files ============== The file(s) affected by this issue are: block/genhd.c Mitigation ========== The Linux kernel CVE team recommends that you update to the latest stable kernel version for this, and many other bugfixes. Individual changes are never tested alone, but rather are part of a larger kernel release. Cherry-picking individual commits is not recommended or supported by the Linux kernel community at all. If however, updating to the latest release is impossible, the individual changes to resolve this issue can be found at these commits: https://git.kernel.org/stable/c/6ae7364f68e6c7af6b6df4bbb14040b89e5975d0 https://git.kernel.org/stable/c/6f06dbe5012c160e0dba418a5a9cb16c456ad46a https://git.kernel.org/stable/c/1a0ae4d502062a2759f2a92d12bdeab3c64c7372 https://git.kernel.org/stable/c/bb03b56d1d754908a37a160603be21769da423cf https://git.kernel.org/stable/c/93d620519d71dfc6ee64b5baea74f1d85d4439fb https://git.kernel.org/stable/c/26cb8ebbfaf713c82e142d08828d4d765057633b