GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2026-80589 (GCVE-0-2026-80589)

Vulnerability from cvelistv5 – Published: 2026-08-26 14:37 – Updated: 2026-08-27 05:02
VLAI
Title
block: stop the timeout timer when releasing a never added disk
Summary
In the Linux kernel, the following vulnerability has been resolved: block: stop the timeout timer when releasing a never added disk disk_release() undoes blk_mq_init_allocated_queue() for a disk whose probe failed before add_disk(), but it only calls blk_mq_exit_queue(). Nothing there stops q->timeout, and that timer rolls forward: it stays pending until it next expires, not until the last request completes. So if the driver issued any I/O before adding the disk, the request_queue is freed while still linked into a timer wheel bucket. Commit 6f8191fdf41d ("block: simplify disk shutdown") dropped the blk_cleanup_queue() call that used to stop it. __del_gendisk() and blk_mq_destroy_queue() still do; only the probe failure path lost it. nvme gets there because nvme_update_ns_info() submits Report Zones or FDP io-mgmt-recv on ns->queue before the disk is added, so a later failure - a concurrent reset setting NVME_CTRL_FROZEN, or device_add_disk() failing - lands in put_disk() with the timer armed: BUG: KASAN: slab-use-after-free in detach_if_pending+0x30c/0x340 Write of size 8 at addr ffff888004d71310 by task kworker/u8:2/37 __timer_delete_sync+0x156/0x240 kernel/time/timer.c:1621 blk_sync_queue+0x22/0x40 block/blk-core.c:222 nvme_sync_queues+0x100/0x150 drivers/nvme/host/core.c:5362 nvme_reset_work+0x138/0x930 drivers/nvme/host/pci.c:3264 Allocated by task 34: __blk_mq_alloc_disk+0x33/0x100 block/blk-mq.c:4462 nvme_alloc_ns+0x290/0x3870 drivers/nvme/host/core.c:4146 Freed by task 0: blk_free_queue_rcu+0x3a/0x50 block/blk-core.c:254 rcu_core+0xc10/0x1730 kernel/rcu/tree.c:2857 The queue being synced there is ctrl->admin_q, only a victim sharing a timer wheel bucket with the freed queue's dangling entry; other runs tripped in enqueue_timer(), __run_timers() or blk_mq_timeout_work(). Failing nvme_alloc_ns() with a debug patch makes it deterministic: one leaked timer trips KASAN within seconds, while 1987 patched releases produced no splat. Stop the timer and the queue work items before blk_mq_exit_queue(), like blk_mq_destroy_queue() does. Found by FuzzNvme.
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 6f8191fdf41d3a53cc1d63fe2234e812c55a0092 , < 6ae7364f68e6c7af6b6df4bbb14040b89e5975d0 (git)
Affected: 6f8191fdf41d3a53cc1d63fe2234e812c55a0092 , < 6f06dbe5012c160e0dba418a5a9cb16c456ad46a (git)
Affected: 6f8191fdf41d3a53cc1d63fe2234e812c55a0092 , < 1a0ae4d502062a2759f2a92d12bdeab3c64c7372 (git)
Affected: 6f8191fdf41d3a53cc1d63fe2234e812c55a0092 , < bb03b56d1d754908a37a160603be21769da423cf (git)
Affected: 6f8191fdf41d3a53cc1d63fe2234e812c55a0092 , < 93d620519d71dfc6ee64b5baea74f1d85d4439fb (git)
Affected: 6f8191fdf41d3a53cc1d63fe2234e812c55a0092 , < 26cb8ebbfaf713c82e142d08828d4d765057633b (git)
Affected: d27b66257db183fe11c10f31246ae965adb005d3 (git)
Affected: 5.19.12 , < 5.20 (semver)
guessed Create a notification for this product.
Linux Linux Affected: 6.0
Unaffected: 0 , < 6.0 (semver)
Unaffected: 6.1.184 , ≤ 6.1.* (semver)
Unaffected: 6.6.153 , ≤ 6.6.* (semver)
Unaffected: 6.12.105 , ≤ 6.12.* (semver)
Unaffected: 6.18.46 , ≤ 6.18.* (semver)
Unaffected: 7.1.10 , ≤ 7.1.* (semver)
Unaffected: 7.2 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "block/genhd.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "6ae7364f68e6c7af6b6df4bbb14040b89e5975d0",
              "status": "affected",
              "version": "6f8191fdf41d3a53cc1d63fe2234e812c55a0092",
              "versionType": "git"
            },
            {
              "lessThan": "6f06dbe5012c160e0dba418a5a9cb16c456ad46a",
              "status": "affected",
              "version": "6f8191fdf41d3a53cc1d63fe2234e812c55a0092",
              "versionType": "git"
            },
            {
              "lessThan": "1a0ae4d502062a2759f2a92d12bdeab3c64c7372",
              "status": "affected",
              "version": "6f8191fdf41d3a53cc1d63fe2234e812c55a0092",
              "versionType": "git"
            },
            {
              "lessThan": "bb03b56d1d754908a37a160603be21769da423cf",
              "status": "affected",
              "version": "6f8191fdf41d3a53cc1d63fe2234e812c55a0092",
              "versionType": "git"
            },
            {
              "lessThan": "93d620519d71dfc6ee64b5baea74f1d85d4439fb",
              "status": "affected",
              "version": "6f8191fdf41d3a53cc1d63fe2234e812c55a0092",
              "versionType": "git"
            },
            {
              "lessThan": "26cb8ebbfaf713c82e142d08828d4d765057633b",
              "status": "affected",
              "version": "6f8191fdf41d3a53cc1d63fe2234e812c55a0092",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "d27b66257db183fe11c10f31246ae965adb005d3",
              "versionType": "git"
            },
            {
              "lessThan": "5.20",
              "status": "affected",
              "version": "5.19.12",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "block/genhd.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.0"
            },
            {
              "lessThan": "6.0",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.184",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.153",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.105",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.46",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.10",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.184",
                  "versionStartIncluding": "6.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.153",
                  "versionStartIncluding": "6.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.105",
                  "versionStartIncluding": "6.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.46",
                  "versionStartIncluding": "6.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.10",
                  "versionStartIncluding": "6.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "6.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "5.19.12",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nblock: stop the timeout timer when releasing a never added disk\n\ndisk_release() undoes blk_mq_init_allocated_queue() for a disk whose\nprobe failed before add_disk(), but it only calls blk_mq_exit_queue().\nNothing there stops q-\u003etimeout, and that timer rolls forward: it stays\npending until it next expires, not until the last request completes.\nSo if the driver issued any I/O before adding the disk, the\nrequest_queue is freed while still linked into a timer wheel bucket.\n\nCommit 6f8191fdf41d (\"block: simplify disk shutdown\") dropped the\nblk_cleanup_queue() call that used to stop it.  __del_gendisk() and\nblk_mq_destroy_queue() still do; only the probe failure path lost it.\n\nnvme gets there because nvme_update_ns_info() submits Report Zones or\nFDP io-mgmt-recv on ns-\u003equeue before the disk is added, so a later\nfailure - a concurrent reset setting NVME_CTRL_FROZEN, or\ndevice_add_disk() failing - lands in put_disk() with the timer armed:\n\n  BUG: KASAN: slab-use-after-free in detach_if_pending+0x30c/0x340\n  Write of size 8 at addr ffff888004d71310 by task kworker/u8:2/37\n   __timer_delete_sync+0x156/0x240 kernel/time/timer.c:1621\n   blk_sync_queue+0x22/0x40 block/blk-core.c:222\n   nvme_sync_queues+0x100/0x150 drivers/nvme/host/core.c:5362\n   nvme_reset_work+0x138/0x930 drivers/nvme/host/pci.c:3264\n\n  Allocated by task 34:\n   __blk_mq_alloc_disk+0x33/0x100 block/blk-mq.c:4462\n   nvme_alloc_ns+0x290/0x3870 drivers/nvme/host/core.c:4146\n\n  Freed by task 0:\n   blk_free_queue_rcu+0x3a/0x50 block/blk-core.c:254\n   rcu_core+0xc10/0x1730 kernel/rcu/tree.c:2857\n\nThe queue being synced there is ctrl-\u003eadmin_q, only a victim sharing a\ntimer wheel bucket with the freed queue\u0027s dangling entry; other runs\ntripped in enqueue_timer(), __run_timers() or blk_mq_timeout_work().\nFailing nvme_alloc_ns() with a debug patch makes it deterministic: one\nleaked timer trips KASAN within seconds, while 1987 patched releases\nproduced no splat.\n\nStop the timer and the queue work items before blk_mq_exit_queue(), like\nblk_mq_destroy_queue() does.\n\nFound by FuzzNvme."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - Exploitation reaches disk_release() via NVMe namespace probing that issues pre-add_disk I/O (FDP io-mgmt-recv, Report Zones) over NVMe-oF TCP/RDMA; a remote or storage-network peer can supply crafted responses during automatic scan/reconnect on cloud/datacenter initiators.\nAC:L - An attacker controlling the NVMe endpoint can reliably time namespace enumeration I/O (arming q-\u003etimeout) with a concurrent probe failure (controller reset/NVME_CTRL_FROZEN or device_add_disk failure); FuzzNvme made this deterministic, and the attacker controls both sides of the race.\nPR:N - No local account or capability is required on the victim host at exploitation time; once an NVMe fabric path exists, a remote/compromised target or storage-network attacker can trigger the probe-failure teardown without CAP_SYS_ADMIN, ioctl, or sysfs access.\nUI:N - The bug fires during automatic kernel namespace scan/reconnect and queue teardown on probe failure; no victim mount, login, or manual device interaction is required beyond normal background storage enumeration.\nS:U - Impact is kernel slab corruption and crashes within the host kernel block layer; it does not cross a VM, container, or IOMMU security boundary even though virtio_blk shares the same pre-add_disk probe pattern.\nC:H - KASAN reports slab use-after-free with an 8-byte write in detach_if_pending on a freed request_queue whose timeout timer remains on the timer wheel; UAF of queue/timer structures enables arbitrary kernel memory disclosure primitives.\nI:H - The dangling timer wheel entry corrupts kernel heap metadata and can affect unrelated queues (e.g., ctrl-\u003eadmin_q in the reported stack); UAF on request_queue/timer state is exploitable for arbitrary write and control-flow hijacking, not merely a crash.\nA:H - Observed impact includes KASAN BUG/oops from timer deletion and queue sync on freed memory; leaked timers also trip in enqueue_timer(), __run_timers(), and blk_mq_timeout_work(), causing kernel panics and denial of service."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-27T05:02:10.391Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/6ae7364f68e6c7af6b6df4bbb14040b89e5975d0"
        },
        {
          "url": "https://git.kernel.org/stable/c/6f06dbe5012c160e0dba418a5a9cb16c456ad46a"
        },
        {
          "url": "https://git.kernel.org/stable/c/1a0ae4d502062a2759f2a92d12bdeab3c64c7372"
        },
        {
          "url": "https://git.kernel.org/stable/c/bb03b56d1d754908a37a160603be21769da423cf"
        },
        {
          "url": "https://git.kernel.org/stable/c/93d620519d71dfc6ee64b5baea74f1d85d4439fb"
        },
        {
          "url": "https://git.kernel.org/stable/c/26cb8ebbfaf713c82e142d08828d4d765057633b"
        }
      ],
      "title": "block: stop the timeout timer when releasing a never added disk",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-80589",
    "datePublished": "2026-08-26T14:37:43.293Z",
    "dateReserved": "2026-08-26T14:34:25.770Z",
    "dateUpdated": "2026-08-27T05:02:10.391Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-80589",
      "date": "2026-09-17",
      "epss": "0.00375",
      "percentile": "0.31224"
    },
    "microsoft_vex": {
      "current_release_date": "2026-08-27T01:03:43.000Z",
      "cve": "CVE-2026-80589",
      "id": "msrc_CVE-2026-80589",
      "initial_release_date": "2026-08-27T01:03:43.000Z",
      "product_status:known_affected": "1",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "block: stop the timeout timer when releasing a never added disk",
      "url": "https://msrc.microsoft.com/csaf/vex/2026/msrc_cve-2026-80589.json",
      "version": "1"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-80589\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2026-08-26T15:17:15.283\",\"lastModified\":\"2026-08-27T06:17:46.553\",\"vulnStatus\":\"Received\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nblock: stop the timeout timer when releasing a never added disk\\n\\ndisk_release() undoes blk_mq_init_allocated_queue() for a disk whose\\nprobe failed before add_disk(), but it only calls blk_mq_exit_queue().\\nNothing there stops q-\u003etimeout, and that timer rolls forward: it stays\\npending until it next expires, not until the last request completes.\\nSo if the driver issued any I/O before adding the disk, the\\nrequest_queue is freed while still linked into a timer wheel bucket.\\n\\nCommit 6f8191fdf41d (\\\"block: simplify disk shutdown\\\") dropped the\\nblk_cleanup_queue() call that used to stop it.  __del_gendisk() and\\nblk_mq_destroy_queue() still do; only the probe failure path lost it.\\n\\nnvme gets there because nvme_update_ns_info() submits Report Zones or\\nFDP io-mgmt-recv on ns-\u003equeue before the disk is added, so a later\\nfailure - a concurrent reset setting NVME_CTRL_FROZEN, or\\ndevice_add_disk() failing - lands in put_disk() with the timer armed:\\n\\n  BUG: KASAN: slab-use-after-free in detach_if_pending+0x30c/0x340\\n  Write of size 8 at addr ffff888004d71310 by task kworker/u8:2/37\\n   __timer_delete_sync+0x156/0x240 kernel/time/timer.c:1621\\n   blk_sync_queue+0x22/0x40 block/blk-core.c:222\\n   nvme_sync_queues+0x100/0x150 drivers/nvme/host/core.c:5362\\n   nvme_reset_work+0x138/0x930 drivers/nvme/host/pci.c:3264\\n\\n  Allocated by task 34:\\n   __blk_mq_alloc_disk+0x33/0x100 block/blk-mq.c:4462\\n   nvme_alloc_ns+0x290/0x3870 drivers/nvme/host/core.c:4146\\n\\n  Freed by task 0:\\n   blk_free_queue_rcu+0x3a/0x50 block/blk-core.c:254\\n   rcu_core+0xc10/0x1730 kernel/rcu/tree.c:2857\\n\\nThe queue being synced there is ctrl-\u003eadmin_q, only a victim sharing a\\ntimer wheel bucket with the freed queue\u0027s dangling entry; other runs\\ntripped in enqueue_timer(), __run_timers() or blk_mq_timeout_work().\\nFailing nvme_alloc_ns() with a debug patch makes it deterministic: one\\nleaked timer trips KASAN within seconds, while 1987 patched releases\\nproduced no splat.\\n\\nStop the timer and the queue work items before blk_mq_exit_queue(), like\\nblk_mq_destroy_queue() does.\\n\\nFound by FuzzNvme.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"block/genhd.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"6f8191fdf41d3a53cc1d63fe2234e812c55a0092\",\"lessThan\":\"6ae7364f68e6c7af6b6df4bbb14040b89e5975d0\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"6f8191fdf41d3a53cc1d63fe2234e812c55a0092\",\"lessThan\":\"6f06dbe5012c160e0dba418a5a9cb16c456ad46a\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"6f8191fdf41d3a53cc1d63fe2234e812c55a0092\",\"lessThan\":\"1a0ae4d502062a2759f2a92d12bdeab3c64c7372\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"6f8191fdf41d3a53cc1d63fe2234e812c55a0092\",\"lessThan\":\"bb03b56d1d754908a37a160603be21769da423cf\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"6f8191fdf41d3a53cc1d63fe2234e812c55a0092\",\"lessThan\":\"93d620519d71dfc6ee64b5baea74f1d85d4439fb\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"6f8191fdf41d3a53cc1d63fe2234e812c55a0092\",\"lessThan\":\"26cb8ebbfaf713c82e142d08828d4d765057633b\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"d27b66257db183fe11c10f31246ae965adb005d3\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"5.19.12\",\"lessThan\":\"5.20\",\"versionType\":\"semver\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"block/genhd.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"6.0\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"6.0\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.1.184\",\"lessThanOrEqual\":\"6.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.6.153\",\"lessThanOrEqual\":\"6.6.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.12.105\",\"lessThanOrEqual\":\"6.12.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.18.46\",\"lessThanOrEqual\":\"6.18.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.1.10\",\"lessThanOrEqual\":\"7.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.2\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":9.8,\"baseSeverity\":\"CRITICAL\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":3.9,\"impactScore\":5.9}]},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/1a0ae4d502062a2759f2a92d12bdeab3c64c7372\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/26cb8ebbfaf713c82e142d08828d4d765057633b\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/6ae7364f68e6c7af6b6df4bbb14040b89e5975d0\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/6f06dbe5012c160e0dba418a5a9cb16c456ad46a\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/93d620519d71dfc6ee64b5baea74f1d85d4439fb\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/bb03b56d1d754908a37a160603be21769da423cf\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-08-27T13:38:59+00:00",
      "cve": "CVE-2026-80589",
      "id": "CVE-2026-80589",
      "initial_release_date": "2026-08-26T00:00:00+00:00",
      "product_status:known_affected": "184",
      "product_status:known_not_affected": "90",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: block: stop the timeout timer when releasing a never added disk",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-80589.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-09-15T01:11:07Z",
      "cve": "CVE-2026-80589",
      "id": "CVE-2026-80589",
      "initial_release_date": "2026-08-27T00:11:22Z",
      "product_status:known_affected": "114",
      "product_status:known_not_affected": "239",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-80589",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-80589.json",
      "version": "5"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.


Loading…

Loading…

Loading…

Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Loading…

Detection rules are retrieved from Rulezet.

Loading…

Loading…

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.


Loading…