CVE-2026-80589

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description A slab-use-after-free issue exists in the block subsystem. The disk release() function fails to stop the q->timeout timer when releasing a disk whose probe failed before add disk(). This occurs because the function calls blk mq exit queue() without stopping the timer, which may remain pending if I/O was issued before the disk was added. Consequently, the request queue can be freed while still linked to a timer wheel bucket, leading to memory corruption when the timer expires. This was observed in the NVMe driver when nvme update ns info() submits requests before the disk is added, and a subsequent failure occurs.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.