Executive brief
The Linux kernel's block storage subsystem contains a flaw where a timeout timer continues to run after the associated storage queue is freed during driver initialization failures. This can cause the kernel to crash or become unstable when accessing already-freed memory, affecting any system using NVMe storage devices or other block drivers that encounter probe failures.
Technical details
The vulnerability is a use-after-free in the block subsystem's timeout handling (CWE-416). When disk_release() is called on a disk whose probe failed before add_disk(), it calls only blk_mq_exit_queue() without stopping the q->timeout timer. This timer remains pending in a timer wheel bucket even after the request_queue is freed via RCU. The root cause stems from commit 6f8191fdf41d which removed a blk_cleanup_queue() call that previously stopped the timer. NVMe drivers are particularly affected because nvme_update_ns_info() issues I/O on a queue before the disk is added, leaving the timer armed when subsequent failures occur. An attacker with the ability to trigger concurrent device resets or device addition failures can cause a kernel use-after-free crash. The fix is to stop the timer and queue work items before blk_mq_exit_queue(), matching the behavior of blk_mq_destroy_queue().
Affected products
- Linux Linux kernel multiple versions (patch available)
Timeline
- 2026-08-26: disclosed