CVE-2026-80589: 
Linux Debian vulnerability analysis and mitigation

CVE-2026-80589 is a use-after-free vulnerability in the Linux kernel's block layer that occurs when releasing a disk whose probe failed before add_disk() was called. Specifically, disk_release() fails to stop the q->timeout timer in the request_queue, leaving it armed and linked into a timer wheel bucket after the queue's memory is freed. The vulnerability was introduced by commit 6f8191fdf41d ("block: simplify disk shutdown"), which removed the blk_cleanup_queue() call from the probe failure path. It was published on August 26, 2026, with a patch advisory added to the GitHub Advisory Database on August 27, 2026. The vulnerability affects Linux kernel versions starting from 6.0 through multiple stable branches, and carries a CVSS v3.1 base score of 9.8 (Critical) — though this score appears inconsistent with the local, kernel-internal nature of the bug (GitHub Advisory, Feedly).

The root cause is a use-after-free (CWE-416) in the Linux kernel block subsystem. When a disk probe fails before add_disk() is invoked, disk_release() calls blk_mq_exit_queue() but does not call blk_sync_queue() or stop the q->timeout timer, unlike the normal shutdown paths (__del_gendisk() and blk_mq_destroy_queue()). The NVMe driver is particularly susceptible because nvme_update_ns_info() submits I/O (e.g., Report Zones or FDP io-mgmt-recv) on ns->queue before the disk is added, arming the timer; a subsequent concurrent reset (NVME_CTRL_FROZEN) or device_add_disk() failure then triggers put_disk() with the timer still active. The freed request_queue remains linked in a timer wheel bucket, and when the timer fires, the kernel accesses freed memory — confirmed by KASAN as a slab-use-after-free write in detach_if_pending(). The fix restores the timer stop and queue work item cancellation before blk_mq_exit_queue(), mirroring what blk_mq_destroy_queue() already does (GitHub Advisory).

Successful exploitation causes a kernel crash (system instability or panic) due to the use-after-free condition triggered when the dangling timer fires against freed memory. The primary impact is a denial of service — the affected system becomes unstable or crashes, disrupting all running workloads. While the assigned CVSS score suggests high confidentiality and integrity impact, the practical impact based on the vulnerability's mechanics is limited to availability loss via kernel crash; there is no demonstrated path to privilege escalation or data exfiltration (Feedly, GitHub Advisory).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the disclosure date (Feedly). The vulnerability was discovered by the FuzzNvme fuzzing tool, and triggering it deterministically requires a debug patch to force nvme_alloc_ns() failure. Exploitation requires local access to a system with NVMe devices and the ability to trigger concurrent device probe failures or resets, making remote exploitation highly unlikely despite the network-based CVSS vector. No threat actor attribution, EPSS score, or CISA KEV catalog entry is currently associated with this CVE.

• Logs: Kernel logs (dmesg / /var/log/kern.log) showing BUG: KASAN: slab-use-after-free errors in detach_if_pending, blk_sync_queue, nvme_sync_queues, or nvme_reset_work.
• Logs: Kernel oops or panic traces referencing __timer_delete_sync at kernel/time/timer.c or blk_mq_timeout_work.
• Process: Kernel worker threads (kworker/u*) crashing or producing KASAN splats during NVMe device probe or reset operations.
• System: Unexpected system reboots or kernel panics on hosts with NVMe storage, particularly during device hotplug, reset, or probe failure events.

Apply the upstream Linux kernel patch that stops the timeout timer and cancels queue work items before calling blk_mq_exit_queue() in the probe failure path of disk_release(). Fixed commits are available for multiple stable branches: 6ae7364f68e6 (one branch), 6f06dbe5012c, 1a0ae4d502062, bb03b56d1d75, 93d620519d71, and 26cb8ebbfaf7. Patched stable releases include kernel versions ≥ 6.1.184, ≥ 6.6.153, ≥ 6.12.105, ≥ 6.18.46, ≥ 7.1.10, and 7.2+. As a workaround where patching is not immediately possible, avoid concurrent NVMe controller resets during device probe phases (GitHub Advisory, Feedly).