CVE-2026-89972 (GCVE-0-2026-89972)
Vulnerability from cvelistv5 – Published: 2026-09-16 10:32 – Updated: 2026-09-16 14:40
VLAI
EPSS
VEX
Title
nvme: add missing SRCU grace period in error path
Summary
In the Linux kernel, the following vulnerability has been resolved:
nvme: add missing SRCU grace period in error path
nvme_alloc_ns() error path at out_unlink_ns removes ns from the
namespace head siblings list with list_del_rcu(&ns->siblings) but
does not wait for SRCU readers before freeing the namespace struct.
Multipath code iterates the head->list under srcu_read_lock() in
nvme_find_path() and nvme_mpath_revalidate_paths(), so a concurrent
reader can still hold a reference to ns when kfree(ns) runs.
The normal removal path in nvme_ns_remove() correctly calls
synchronize_srcu(&ns->head->srcu) after list_del_rcu() to wait for
in-progress readers. Add the same grace period in the error path.
Severity
9.8 (Critical)
Assigner
References
Impacted products
2 products
| Vendor | Product | Version | CPE status | |
|---|---|---|---|---|
| Linux | Linux |
Affected:
ed754e5deeb17f4e675c84e4b6c640cc7344e498 , < d663944dbad81bb0e3635d7090db4713e6300858
(git)
Affected: ed754e5deeb17f4e675c84e4b6c640cc7344e498 , < 76023560d60f10b4f808941163aa2975f1631683 (git) Affected: ed754e5deeb17f4e675c84e4b6c640cc7344e498 , < ef248d5de4469fb6bbaf8dbe0c4c47800080d648 (git) |
guessed | |
| Linux | Linux |
Affected:
4.15
Unaffected: 0 , < 4.15 (semver) Unaffected: 6.18.51 , ≤ 6.18.* (semver) Unaffected: 7.2.5 , ≤ 7.2.* (semver) Unaffected: 7.3-rc2 , ≤ * (original_commit_for_fix) |
guessed |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/nvme/host/core.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "d663944dbad81bb0e3635d7090db4713e6300858",
"status": "affected",
"version": "ed754e5deeb17f4e675c84e4b6c640cc7344e498",
"versionType": "git"
},
{
"lessThan": "76023560d60f10b4f808941163aa2975f1631683",
"status": "affected",
"version": "ed754e5deeb17f4e675c84e4b6c640cc7344e498",
"versionType": "git"
},
{
"lessThan": "ef248d5de4469fb6bbaf8dbe0c4c47800080d648",
"status": "affected",
"version": "ed754e5deeb17f4e675c84e4b6c640cc7344e498",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/nvme/host/core.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.15"
},
{
"lessThan": "4.15",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.51",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.5",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3-rc2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.51",
"versionStartIncluding": "4.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.5",
"versionStartIncluding": "4.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3-rc2",
"versionStartIncluding": "4.15",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnvme: add missing SRCU grace period in error path\n\nnvme_alloc_ns() error path at out_unlink_ns removes ns from the\nnamespace head siblings list with list_del_rcu(\u0026ns-\u003esiblings) but\ndoes not wait for SRCU readers before freeing the namespace struct.\nMultipath code iterates the head-\u003elist under srcu_read_lock() in\nnvme_find_path() and nvme_mpath_revalidate_paths(), so a concurrent\nreader can still hold a reference to ns when kfree(ns) runs.\n\nThe normal removal path in nvme_ns_remove() correctly calls\nsynchronize_srcu(\u0026ns-\u003ehead-\u003esrcu) after list_del_rcu() to wait for\nin-progress readers. Add the same grace period in the error path."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:N - NVMe host core scans namespaces from NVMe-oF (nvme-tcp/rdma/fc) when a remote target sends NS_CHANGED AENs or Identify data; a malicious or compromised fabric target drives nvme_scan_ns\u2192nvme_alloc_ns and the out_unlink_ns UAF over the network (typically TCP 4420).\nAC:L - The remote target controls both sides of the race: it can stall then fail Identify after list_add_tail_rcu so the new path is on head-\u003elist, while concurrent multipath I/O or ANA AENs walk that list under srcu_read_lock in nvme_find_path/nvme_mpath_revalidate_paths; CONFIG_NVME_MULTIPATH is the recommended default.\nPR:N - The attacker is the NVMe-oF peer and needs no host account or capability; NVMe/TCP is unauthenticated by default (TLS and DH-HMAC-CHAP are optional), and AENs plus Identify responses are accepted on an already-established fabrics session.\nUI:N - NVMe-oF controllers are persistent boot/autoconnect configuration; namespace rescans, ANA updates, and multipath I/O run from kernel workqueues and the block layer with no further victim action at exploit time.\nS:U - The use-after-free corrupts kernel heap (struct nvme_ns) inside the host NVMe driver and does not cross a VM, IOMMU, or other distinct security authority.\nC:H - Use-after-free of the namespace object on the multipath siblings list lets an attacker reclaim the kmalloc slab and obtain a kernel read primitive from stale ns-\u003edisk/ctrl/flags dereferences in nvme_find_path.\nI:H - The same UAF is heap-sprayable: multipath I/O and ioctl paths dereference fields of the freed nvme_ns, enabling arbitrary write and control-flow hijacking in kernel context.\nA:H - Any use-after-free of ns during the SRCU list walk can oops or panic the host kernel even without a full exploit, taking down the NVMe storage stack."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-16T14:40:52.882Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/d663944dbad81bb0e3635d7090db4713e6300858"
},
{
"url": "https://git.kernel.org/stable/c/76023560d60f10b4f808941163aa2975f1631683"
},
{
"url": "https://git.kernel.org/stable/c/ef248d5de4469fb6bbaf8dbe0c4c47800080d648"
}
],
"title": "nvme: add missing SRCU grace period in error path",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-89972",
"datePublished": "2026-09-16T10:32:51.701Z",
"dateReserved": "2026-09-11T19:38:34.778Z",
"dateUpdated": "2026-09-16T14:40:52.882Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"vulnerability-lookup:meta": {
"nvd": "{\"cve\":{\"id\":\"CVE-2026-89972\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2026-09-16T11:17:07.953\",\"lastModified\":\"2026-09-16T15:18:21.637\",\"vulnStatus\":\"Received\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nnvme: add missing SRCU grace period in error path\\n\\nnvme_alloc_ns() error path at out_unlink_ns removes ns from the\\nnamespace head siblings list with list_del_rcu(\u0026ns-\u003esiblings) but\\ndoes not wait for SRCU readers before freeing the namespace struct.\\nMultipath code iterates the head-\u003elist under srcu_read_lock() in\\nnvme_find_path() and nvme_mpath_revalidate_paths(), so a concurrent\\nreader can still hold a reference to ns when kfree(ns) runs.\\n\\nThe normal removal path in nvme_ns_remove() correctly calls\\nsynchronize_srcu(\u0026ns-\u003ehead-\u003esrcu) after list_del_rcu() to wait for\\nin-progress readers. Add the same grace period in the error path.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"drivers/nvme/host/core.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"ed754e5deeb17f4e675c84e4b6c640cc7344e498\",\"lessThan\":\"d663944dbad81bb0e3635d7090db4713e6300858\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"ed754e5deeb17f4e675c84e4b6c640cc7344e498\",\"lessThan\":\"76023560d60f10b4f808941163aa2975f1631683\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"ed754e5deeb17f4e675c84e4b6c640cc7344e498\",\"lessThan\":\"ef248d5de4469fb6bbaf8dbe0c4c47800080d648\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"drivers/nvme/host/core.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"4.15\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"4.15\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.18.51\",\"lessThanOrEqual\":\"6.18.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.2.5\",\"lessThanOrEqual\":\"7.2.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.3-rc2\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":9.8,\"baseSeverity\":\"CRITICAL\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":3.9,\"impactScore\":5.9}]},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/76023560d60f10b4f808941163aa2975f1631683\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/d663944dbad81bb0e3635d7090db4713e6300858\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/ef248d5de4469fb6bbaf8dbe0c4c47800080d648\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}"
}
}
Loading…
Loading…
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the
vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base
model, served locally by ML-Gateway.
They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
Loading…
Related by attack behaviour
Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.
Loading…