Linux kernel nvmet-auth: use-after-free when auth timeout work races SQ teardown

Impact

nvmet_auth_sq_free() cancelled the authentication-expiry work without waiting for an already-running callback, so transport teardown could free or reuse the queue while nvmet_auth_expired_work() was still touching that struct nvmet_sq. A remote initiator that starts in-band authentication and then drops the connection at the right moment can drive the race, giving kernel memory corruption on the storage target. On a GPU fleet the exposure is the NVMe-oF target nodes serving dataset and checkpoint volumes; a crash there stalls every job with a namespace mounted from that node.

Who can reach it

Any initiator that can reach the NVMe-oF target and begin in-band authentication, then tear the queue down. The race is timing-dependent, not a deterministic exploit.

What to do

Update to a kernel containing the fix (teardown now synchronously drains the delayed work) and reboot the affected target nodes. No standalone mitigation short of disabling in-band authentication or restricting which initiators can connect. The record gives stable commits only, no distribution-fixed version.

References

Related entries

• Linux kernel nvme: missing SRCU grace period on the namespace-allocation error pathCVE-2026-89972 · Linux kernel nvme host (nvme_alloc_ns error path, multipath sibling list)Critical
• Linux kernel CephFS client: use-after-free when an MDS session reopens during an access checkCVE-2026-89990 · Linux kernel CephFS client (ceph_mds_check_access)Critical
• Linux kernel NFSD: client use-after-free when the laundromat reaps a blocked lockCVE-2026-90036 · Linux kernel NFSD (blocked-lock laundromat reaping)Critical
• Linux kernel NFSD: client use-after-free when the laundromat reaps close_lru open ownersCVE-2026-90037 · Linux kernel NFSD (close_lru laundromat reaping)Critical
• Linux kernel NFSD: client use-after-free when an export is removed during client expiryCVE-2026-90038 · Linux kernel NFSD (nfsd4_revoke_export_states, export unlock path)Critical
• Linux kernel CephFS client: oops decrypting filenames from vmalloc() message buffersCVE-2026-90042 · Linux kernel CephFS client (ceph_fname_to_usr, fscrypt filename decryption)Critical