CVE-2026-89972

A flaw was found in the NVMe (Non-Volatile Memory Express) driver of the Linux kernel. The nvme_alloc_ns() function's error handling path fails to wait for all SRCU (Sleepable Read-Copy Update) readers to complete before freeing a namespace structure. This oversight allows a concurrent reader to access a freed memory region, leading to a use-after-free vulnerability. A local attacker could potentially exploit this to cause a system crash or achieve arbitrary code execution.

This vulnerability is rated with an Important severity impact because, although exploitation requires local privileges rather than remote access, successful execution can compromise kernel memory integrity and allow arbitrary code execution. The risk manifests on systems configured with NVMe storage subsystems, where namespace error recovery operations can allow concurrent readers to reference released data structures. Standard installations operating on NVMe storage are susceptible during namespace teardown failures, whereas enterprise Linux 7 and earlier releases lack the vulnerable multipath synchronization logic.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.