CVE-2026-89970

In the Linux kernel, the following vulnerability has been resolved:

nvmet-auth: Synchronize timeout work during SQ teardown

nvmetauthsqfree() cancels authexpired_work with

canceldelayedwork(). If the work has already started, cancellation does

not wait for the callback. Transport teardown can consequently free or

reuse the queue containing struct nvmet_sq while

nvmetauthexpired_work() still accesses that SQ.

Add a teardown-specific helper that synchronously drains the delayed work

before freeing authentication state, and use it from nvmetsqdestroy().

Keep the non-synchronous helper for in-band authentication state cleanup,

where the SQ owner remains alive.