CVE-2026-80589

Technical Description

In the Linux kernel, the following vulnerability has been resolved:

block: stop the timeout timer when releasing a never added disk

disk_release() undoes blk_mq_init_allocated_queue() for a disk whose

probe failed before add_disk(), but it only calls blk_mq_exit_queue().

Nothing there stops q->timeout, and that timer rolls forward: it stays

pending until it next expires, not until the last request completes.

So if the driver issued any I/O before adding the disk, the

request_queue is freed while still linked into a timer wheel bucket.

Commit 6f8191fdf41d ("block: simplify disk shutdown") dropped the

blk_cleanup_queue() call that used to stop it. __del_gendisk() and

blk_mq_destroy_queue() still do; only the probe failure path lost it.

nvme gets there because nvme_update_ns_info() submits Report Zones or

FDP io-mgmt-recv on ns->queue before the disk is added, so a later

failure - a concurrent reset setting NVME_CTRL_FROZEN, or

device_add_disk() failing - lands in put_disk() with the

Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

References