DEBIAN-CVE-2026-80589

In the Linux kernel, the following vulnerability has been resolved:  block: stop the timeout timer when releasing a never added disk  diskrelease() undoes blkmqinitallocatedqueue() for a disk whose probe failed before adddisk(), but it only calls blkmqexitqueue(). Nothing there stops q->timeout, and that timer rolls forward: it stays pending until it next expires, not until the last request completes. So if the driver issued any I/O before adding the disk, the requestqueue is freed while still linked into a timer wheel bucket.  Commit 6f8191fdf41d ("block: simplify disk shutdown") dropped the blkcleanupqueue() call that used to stop it.  delgendisk() and blkmqdestroyqueue() still do; only the probe failure path lost it.  nvme gets there because nvmeupdatensinfo() submits Report Zones or FDP io-mgmt-recv on ns->queue before the disk is added, so a later failure - a concurrent reset setting NVMECTRLFROZEN, or deviceadddisk() failing - lands in putdisk() with the timer armed:    BUG: KASAN: slab-use-after-free in detachifpending+0x30c/0x340   Write of size 8 at addr ffff888004d71310 by task kworker/u8:2/37    timerdeletesync+0x156/0x240 kernel/time/timer.c:1621    blksyncqueue+0x22/0x40 block/blk-core.c:222    nvmesyncqueues+0x100/0x150 drivers/nvme/host/core.c:5362    nvmeresetwork+0x138/0x930 drivers/nvme/host/pci.c:3264    Allocated by task 34:    _blkmqallocdisk+0x33/0x100 block/blk-mq.c:4462    nvmeallocns+0x290/0x3870 drivers/nvme/host/core.c:4146    Freed by task 0:    blkfreequeuercu+0x3a/0x50 block/blk-core.c:254    rcucore+0xc10/0x1730 kernel/rcu/tree.c:2857  The queue being synced there is ctrl->adminq, only a victim sharing a timer wheel bucket with the freed queue's dangling entry; other runs tripped in enqueuetimer(), _runtimers() or blkmqtimeoutwork(). Failing nvmeallocns() with a debug patch makes it deterministic: one leaked timer trips KASAN within seconds, while 1987 patched releases produced no splat.  Stop the timer and the queue work items before blkmqexitqueue(), like blkmqdestroy_queue() does.  Found by FuzzNvme.