CVE-2026-89970

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description A race condition exists in the nvmet-auth component during the teardown of a Submission Queue (SQ). The function nvmet auth sq free() uses cancel delayed work() to cancel auth expired work(), but this method does not wait for the callback if the work has already started. This allows the transport teardown process to free or reuse the queue containing the nvmet sq structure while nvmet auth expired work() is still accessing it, potentially leading to a use-after-free scenario.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.