Answer in brief
CVE-2026-80589 records a Critical severity (CVSS 9.8) vulnerability in block: stop the timeout timer when releasing a never added disk. The current sources do not mark it as known exploited. The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
CVSS is 9.8. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| Linux/Linuxgeneric | >=6f8191fdf41d3a53cc1d63fe2234e812c55a0092 <6ae7364f68e6c7af6b6df4bbb14040b89e5975d0 || >=6f8191fdf41d3a53cc1d63fe2234e812c55a0092 <6f06dbe5012c160e0dba418a5a9cb16c456ad46a || >=6f8191fdf41d3a53cc1d63fe2234e812c55a0092 <1a0ae4d502062a2759f2a92d12bdeab3c64c7372 || >=6f8191fdf41d3a53cc1d63fe2234e812c55a0092 <bb03b56d1d754908a37a160603be21769da423cf || >=6f8191fdf41d3a53cc1d63fe2234e812c55a0092 <93d620519d71dfc6ee64b5baea74f1d85d4439fb || >=6f8191fdf41d3a53cc1d63fe2234e812c55a0092 <26cb8ebbfaf713c82e142d08828d4d765057633b || d27b66257db183fe11c10f31246ae965adb005d3 || >=5.19.12 <5.20 | 6ae7364f68e6c7af6b6df4bbb14040b89e5975d0, 6f06dbe5012c160e0dba418a5a9cb16c456ad46a, 1a0ae4d502062a2759f2a92d12bdeab3c64c7372, bb03b56d1d754908a37a160603be21769da423cf, 93d620519d71dfc6ee64b5baea74f1d85d4439fb, 26cb8ebbfaf713c82e142d08828d4d765057633b, 5.20 |
| Linux/Linuxgeneric | 6.0 | Not reported |
Published upstream
Aug 26, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Aug 27, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Aug 26, 2026
In the Linux kernel, the following vulnerability has been resolved: block: stop the timeout timer when releasing a never added disk disk_release() undoes blk_mq_init_allocated_queue() for a disk whose probe failed before add_disk(), but it only calls blk_mq_exit_queue(). Nothing there stops q->timeout, and that timer rolls forward: it stays pending until it next expires, not until the last request completes. So if the driver issued any I/O before adding the disk, the request_queue is freed while still linked into a timer wheel bucket. Commit 6f8191fdf41d ("block: simplify disk shutdown") dropped the blk_cleanup_queue() call that used to stop it. __del_gendisk() and blk_mq_destroy_queue() still do; only the probe failure path lost it. nvme gets there because nvme_update_ns_info() submits Report Zones or FDP io-mgmt-recv on ns->queue before the disk is added, so a later failure - a concurrent reset setting NVME_CTRL_FROZEN, or device_add_disk() failing - lands in put_disk() with the timer armed: BUG: KASAN: slab-use-after-free in detach_if_pending+0x30c/0x340 Write of size 8 at addr ffff888004d71310 by task kworker/u8:2/37 __timer_delete_sync+0x156/0x240 kernel/time/timer.c:1621 blk_sync_queue+0x22/0x40 block/blk-core.c:222 nvme_sync_queues+0x100/0x150 drivers/nvme/host/core.c:5362 nvme_reset_work+0x138/0x930 drivers/nvme/host/pci.c:3264 Allocated by task 34: __blk_mq_alloc_disk+0x33/0x100 block/blk-mq.c:4462 nvme_alloc_ns+0x290/0x3870 drivers/nvme/host/core.c:4146 Freed by task 0: blk_free_queue_rcu+0x3a/0x50 block/blk-core.c:254 rcu_core+0xc10/0x1730 kernel/rcu/tree.c:2857 The queue being synced there is ctrl->admin_q, only a victim sharing a timer wheel bucket with the freed queue's dangling entry; other runs tripped in enqueue_timer(), __run_timers() or blk_mq_timeout_work(). Failing nvme_alloc_ns() with a debug patch makes it deterministic: one leaked timer trips KASAN within seconds, while 1987 patched releases produced no splat. Stop the timer and the queue work items before blk_mq_exit_queue(), like blk_mq_destroy_queue() does. Found by FuzzNvme.
Quoted source text, attributed separately from HOL analysis.