Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
In the Linux kernel, the following vulnerability has been resolved: nvmet-auth: Synchronize timeout work during SQ teardown nvmet_auth_sq_free() cancels auth_expired_work with cancel_delayed_work(). If the work has already started, cancellation does not wait for the callback. Transport teardown can consequently free or reuse the queue containing struct nvmet_sq while nvmet_auth_expired_work() still accesses that SQ. Add a teardown-specific helper that synchronously drains the delayed work before freeing authentication state, and use it from nvmet_sq_destroy(). Keep the non-synchronous helper for in-band authentication state cleanup, where the SQ owner remains alive.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
AVAILABLE
Momentum
STABLE
| Date | Total | Labels |
|---|
| 2026-09-16 | 1 | Disclosure1 |
| 2026-09-29 | 1 | Patch1 |
最近暇だったからLLMと一緒にLinuxカーネルの脆弱性を探してたんだけど、そこで見つけた脆弱性が修正され、正式にCVE-2026-89970として公開されました！ ネットワーク越しに認証前から到達でき、解放済みのカーネルメモリに書き込める危険な脆弱性です 初CVEゲット 🎉 https://www.cve.org/CVERecord?id=CVE-2026-89970 https://t.co/w0lhjExKB4
Post summary
The author discovered a Linux kernel vulnerability that was assigned CVE-2026-89970; it is a pre-auth network-reachable use-after-free allowing writes to freed kernel memory.
🚨 CRITICAL: CVE-2026-89970 (CVSS 9.8) Linux kernel nvmet-auth race condition allows remote exploitation. Use-after-free in SQ teardown can lead to complete system compromise. Patch immediately. #CVE #Vulnerability #PatchNow #Linux https://t.co/WpRB8vc9ZX
Post summary
The post describes CVE-2026-89970, a critical Linux kernel nvmet-auth race condition (CVSS 9.8) that could allow remote compromise, and urges immediate patching.