CVE-2026-89970

The Linux kernel's NVMe over Fabrics target authentication code (nvmet-auth) contains a use-after-free race: nvmet_auth_sq_free() cancels the authentication expiration delayed work with cancel_delayed_work(), which does not wait if the callback has already started executing. If an attacker triggers authentication expiration timing that overlaps with queue teardown, the transport layer can free or reuse the queue containing struct nvmet_sq while nvmet_auth_expired_work() is still accessing it, corrupting target-side kernel memory. A remote NVMe host that can reach the target and negotiate in-band authentication (e.g., by disconnecting at the right moment during the auth timeout window) could potentially crash the target or, per the assigned CVSS 9.8 rating, achieve high confidentiality, integrity, and availability impact through memory corruption. Only systems running the Linux kernel as an NVMe-oF target (nvmet subsystem) with in-band authentication support and authentication configured are affected. No public proof-of-concept, CISA KEV listing, or confirmed in-the-wild exploitation is known.

What to do: Update the kernel to a release containing the nvmet-auth synchronous teardown fix (check your distribution's security advisory for the backport of CVE-2026-89970). Until patched, disable in-band authentication (DH-HMAC-CHAP) on nvmet targets or restrict NVMe/TCP traffic (port 4420) to trusted storage networks with host and network ACLs. Verify whether your hosts run the in-kernel nvmet target with authentication enabled, and monitor for unexpected host disconnects coinciding with authentication timeouts.