Description

In the Linux kernel, the following vulnerability has been resolved: block: stop the timeout timer when releasing a never added disk disk_release() undoes blk_mq_init_allocated_queue() for a disk whose probe failed before add_disk(), but it only calls blk_mq_exit_queue(). Nothing there stops q->timeout, and that timer rolls forward: it stays pending until it next expires, not until the last request completes. So if the driver issued any I/O before adding the disk, the request_queue is freed while still linked into a timer wheel bucket. Commit 6f8191fdf41d ("block: simplify disk shutdown") dropped the blk_cleanup_queue() call that used to stop it. __del_gendisk() and blk_mq_destroy_queue() still do; only the probe failure path lost it. nvme gets there because nvme_update_ns_info() submits Report Zones or FDP io-mgmt-recv on ns->queue before the disk is added, so a later failure - a concurrent reset setting NVME_CTRL_FROZEN, or device_add_disk() failing - lands in put_disk() with the timer armed: BUG: KASAN: slab-use-after-free in detach_if_pending+0x30c/0x340 Write of size 8 at addr ffff888004d71310 by task kworker/u8:2/37 __timer_delete_sync+0x156/0x240 kernel/time/timer.c:1621 blk_sync_queue+0x22/0x40 block/blk-core.c:222 nvme_sync_queues+0x100/0x150 drivers/nvme/host/core.c:5362 nvme_reset_work+0x138/0x930 drivers/nvme/host/pci.c:3264 Allocated by task 34: __blk_mq_alloc_disk+0x33/0x100 block/blk-mq.c:4462 nvme_alloc_ns+0x290/0x3870 drivers/nvme/host/core.c:4146 Freed by task 0: blk_free_queue_rcu+0x3a/0x50 block/blk-core.c:254 rcu_core+0xc10/0x1730 kernel/rcu/tree.c:2857 The queue being synced there is ctrl->admin_q, only a victim sharing a timer wheel bucket with the freed queue's dangling entry; other runs tripped in enqueue_timer(), __run_timers() or blk_mq_timeout_work(). Failing nvme_alloc_ns() with a debug patch makes it deterministic: one leaked timer trips KASAN within seconds, while 1987 patched releases produced no splat. Stop the timer and the queue work items before blk_mq_exit_queue(), like blk_mq_destroy_queue() does. Found by FuzzNvme.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.8",
  "pubDate": "2026-08-26T15:17:15.283Z",
  "pubdate": "2026-08-26T15:17:15.283Z",
  "executiveSummary": "A use-after-free vulnerability exists in the Linux kernel block layer, specifically within the disk release path for queues that failed to initialize fully. The vulnerability occurs when a block device's request_queue is freed while its associated timeout timer remains active and linked to a timer wheel bucket.\nThis flaw affects systems where block drivers (like NVMe) submit I/O requests before a disk is successfully added via add_disk(). If the disk probe fails, the cleanup process for the request_queue fails to terminate the pending timeout timer, leading to a dangling pointer reference.\nSuccessful exploitation results in kernel memory corruption and a potential system crash or denial-of-service (DoS) condition. As the kernel attempts to manage the dangling timer in the timer wheel, it accesses memory that has already been deallocated, triggering a slab-use-after-free error. This vulnerability does not require authentication for local exploitation, as it is triggered during routine hardware initialization or error-handling paths within the kernel.\nThe risk is categorized as high due to the potential for kernel instability and non-deterministic exploitability, which could be leveraged to disrupt system operation.",
  "technicalDetails": "The root cause of this vulnerability is an incomplete cleanup process in the disk_release() function. When a block device probe fails prior to the invocation of add_disk(), the kernel attempts to release resources via blk_mq_exit_queue(). However, this function fails to stop the internal request_queue timeout timer (q->timeout).\nUnder normal operation, the timeout timer is responsible for monitoring pending I/O requests. If a driver (such as the NVMe driver) initiates I/O operations (e.g., Report Zones or FDP io-mgmt-recv) before the disk is added, the timer becomes armed. If the disk addition subsequently fails, the queue is destroyed while the timer remains queued in the kernel's timer wheel bucket.\nThe attack flow proceeds as follows: 1) An NVMe namespace is allocated, and the request_queue is initialized. 2) The driver submits I/O requests, arming the timeout timer. 3) A device-side reset or initialization failure occurs, triggering the disk release path. 4) The kernel executes blk_mq_exit_queue(), which frees the queue structure memory without canceling the pending timer. 5) The timer eventually expires. 6) The kernel's timer subsystem attempts to process the timer, accessing the freed memory address previously associated with the queue (a slab-use-after-free).\nThis behavior was exacerbated by the commit 6f8191fdf41d ('block: simplify disk shutdown'), which removed the blk_cleanup_queue() call that previously handled timer cancellation in these code paths. The vulnerability is triggered during error-handling logic within the kernel driver stack.\nThe technical impact is severe; the kernel's timer wheel attempts to dereference pointers to structures (like request_queue) that have already been reclaimed by the slab allocator, leading to memory corruption (KASAN detects this as a slab-use-after-free). Depending on the system state, this can manifest as a kernel panic during routine task scheduling, such as within blk_sync_queue() or __run_timers().\nThere are no specific privilege requirements for triggering this other than those needed to interact with the device driver during initialization. The exposure is local to the kernel environment, making it a critical concern for hardware stability."
}