Executive brief
The Linux kernel's NVMe target authentication subsystem contains a race condition where storage queue teardown can free memory while an expiration timeout handler is still accessing it. An attacker with network access to an NVMe target could exploit this to cause kernel crashes or potentially execute arbitrary code, disrupting storage services or compromising system integrity.
Technical details
The vulnerability is a use-after-free race condition in the nvmet-auth subsystem. The function nvmet_auth_sq_free() uses cancel_delayed_work() to cancel auth_expired_work, but this does not wait for an already-running callback to complete. When nvmet_sq_destroy() tears down a storage queue, the auth state can be freed while nvmet_auth_expired_work() is still executing and accessing that same queue structure. The fix adds a new nvmet_auth_sq_destroy() helper that uses cancel_delayed_work_sync() to synchronously drain the delayed work before freeing the authentication state, called from nvmet_sq_destroy(). The vulnerability affects NVMe target implementations with authentication enabled and is exploitable remotely over the network.
Affected products
- Linux Linux Kernel versions prior to 2026-09-14 with nvmet-auth enabled
Timeline
- 2026-09-16: disclosed
- 2026-09-14: patched: Patch committed to stable kernel tree