CVE-2026-80589

A flaw was found in the Linux kernel's block subsystem. This vulnerability occurs when a disk's initialization fails before it is fully integrated, causing a critical timer to remain active even after the associated memory is released. This improper handling of memory can lead to a use-after-free condition, potentially allowing a local attacker to trigger a system crash and cause a denial of service.

A use-after-free can occur in the block layer when disk_release() handles a probe failure for a disk that was never added. If I/O was issued before add_disk(), the request_queue timeout timer can remain armed after the queue is freed and later timer handling may write through the dangling timer entry. This is primarily a local high complexity trigger involving failed device probe or reset paths, observed through NVMe namespace setup and KASAN splats in timer and blk_mq timeout code. For the CVSS the PR:L is used for the paranoid score because an unprivileged or reduced privilege local actor may be able to influence reset or reprobe flows in some deployments, although reliable triggering often needs device control or a faulty or malicious controller. The issue is not a generic remote network bug, but storage fabrics or virtualized device models can expand the practical attack surface. Impact is at least denial of service via kernel crash and in the paranoid interpretation may include confidentiality and integrity impact due to use-after-free memory corruption.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.