Disk Release Issue in Linux Kernel Affects Various NVMe Devices

CVE-2026-80589

What is CVE-2026-80589?

A vulnerability exists in the Linux kernel's handling of disk releases, where the timeout timer is not properly stopped upon releasing an unadded disk. This can lead to a situation where a freed request queue remains linked to a timer wheel bucket, potentially causing use-after-free errors. Specifically, if any I/O operations were issued before the disk was added, it could result in invalid memory access during subsequent operations, as observed with NVMe devices. Proper management of timer synchronization and queue release processes is critical to mitigate this risk.

References