CVE-2026-80589

In the Linux kernel, the following vulnerability has been resolved:

block: stop the timeout timer when releasing a never added disk

diskrelease() undoes blkmqinitallocated_queue() for a disk whose

probe failed before adddisk(), but it only calls blkmqexitqueue().

Nothing there stops q->timeout, and that timer rolls forward: it stays

pending until it next expires, not until the last request completes.

So if the driver issued any I/O before adding the disk, the

request_queue is freed while still linked into a timer wheel bucket.

Commit 6f8191fdf41d ("block: simplify disk shutdown") dropped the

blkcleanupqueue() call that used to stop it.  _delgendisk() and

blkmqdestroy_queue() still do; only the probe failure path lost it.

nvme gets there because nvmeupdatens_info() submits Report Zones or

FDP io-mgmt-recv on ns->queue before the disk is added, so a later

failure - a concurrent reset setting NVMECTRLFROZEN, or

deviceadddisk() failing - lands in put_disk() with the timer armed:

  BUG: KASAN: slab-use-after-free in detachifpending+0x30c/0x340

  Write of size 8 at addr ffff888004d71310 by task kworker/u8:2/37

   _timerdelete_sync+0x156/0x240 kernel/time/timer.c:1621

   blksyncqueue+0x22/0x40 block/blk-core.c:222

   nvmesyncqueues+0x100/0x150 drivers/nvme/host/core.c:5362

   nvmeresetwork+0x138/0x930 drivers/nvme/host/pci.c:3264

  Allocated by task 34:

   _blkmqallocdisk+0x33/0x100 block/blk-mq.c:4462

   nvmeallocns+0x290/0x3870 drivers/nvme/host/core.c:4146

  Freed by task 0:

   blkfreequeue_rcu+0x3a/0x50 block/blk-core.c:254

   rcu_core+0xc10/0x1730 kernel/rcu/tree.c:2857

The queue being synced there is ctrl->admin_q, only a victim sharing a

timer wheel bucket with the freed queue's dangling entry; other runs

tripped in enqueuetimer(), runtimers() or blkmqtimeout_work().

Failing nvmeallocns() with a debug patch makes it deterministic: one

leaked timer trips KASAN within seconds, while 1987 patched releases

produced no splat.

Stop the timer and the queue work items before blkmqexit_queue(), like

blkmqdestroy_queue() does.

Found by FuzzNvme.