CVE-2026-89970

A flaw was found in the nvmet-auth component of the Linux kernel. A timing issue during the cleanup of a Submission Queue (SQ) can lead to a use-after-free vulnerability. This occurs when a delayed authentication task attempts to access memory that has already been released or repurposed. An attacker could potentially exploit this to cause a system crash (denial of service) or other memory corruption impacts.

This vulnerability is rated as an Important severity flaw because an exploitable use-after-free condition within the kernel memory space can lead to denial of service through system crashes or potentially local privilege escalation. In standard Red Hat Enterprise Linux installations, the NVMe over Fabrics target subsystem is neither loaded nor configured by default, significantly limiting the exposure to systems designated as NVMe-oF storage targets. Exploitation is further confined to environments configured with in-band authentication during queue teardown operations.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Prevent the NVMe target kernel module from loading if the host is not intended to operate as an NVMe over Fabrics target server.

1. Create a modprobe configuration file to disable the module:

echo "install nvmet /bin/true" > /etc/modprobe.d/disable-nvmet.conf

2. If the module is already loaded, remove it:

modprobe -r nvmet

Caveats: This configuration prevents the host from functioning as an NVMe-oF target. It does not disrupt normal NVMe host/initiator storage capabilities.

Warning: If the nvmet module is currently in use, removing it or restarting the host will terminate existing NVMe target storage connections and disrupt attached clients.