« Volver al listado

CVE-2026-90185

Estado: RecibidaSin puntuar—

In the Linux kernel, the following vulnerability has been resolved:

null_blk: serialize configfs attribute stores with the lock

The NULLB_DEVICE_ATTR _store takes no lock: apply_fn attributes (submit_queues, poll_queues) get dev->NAME written again after apply_fn returns, outside its lock; APPLY=NULL attributes are entirely lockless. configfs only serializes stores per-open-file, so concurrent stores on separate fds race.

For apply_fn attributes, once one store's apply_fn has reconfigured the hardware, a second (losing) store can still overwrite dev->NAME afterwards. This leaves dev->submit_queues out of sync with the live queue count, which is later caught by the WARN_ON_ONCE() in null_map_queues().

Leer descripción completaMostrar menos

For !apply_fn attributes, power_store()'s null_add_dev() validates and builds the device under "lock" but only sets CONFIGURED afterwards. A store slipping in during this window can change a field mid-setup -- for example, zone_nr_conv can be pushed above nr_zones after it has already been clamped, leading to an out-of-bounds dev->zones[] access.

Take "lock" in the macro around the apply_fn call, the CONFIGURED test and the field write, and move it out of nullb_apply_submit_queues()/ nullb_apply_poll_queues() so both paths are covered once. This serializes stores with power_store's setup and with each other.

CVSS

NVD no ha asignado puntuación CVSS a esta CVE (habitual desde el cambio de política de abril de 2026).

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

Linux — Linux KernelAI

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2026-90185",
  "cveTags": [],
  "metrics": {},
  "affected": [
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "affectedData": [
        {
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "product": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "45919fbfe1c487c17ea1d198534339a5e8abeae3",
              "lessThan": "8e839ed5210399a0330a8a6c5885c1d40a537c6d",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "45919fbfe1c487c17ea1d198534339a5e8abeae3",
              "lessThan": "88d806d0e1d36246208386a8e55b511c1b3d647c",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "45919fbfe1c487c17ea1d198534339a5e8abeae3",
              "lessThan": "3945ce8cbce4e328e6fdf0b522dc71e340de19db",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "45919fbfe1c487c17ea1d198534339a5e8abeae3",
              "lessThan": "65cae82fd3c39b53430672cb9e3ecd267471a6ce",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "45919fbfe1c487c17ea1d198534339a5e8abeae3",
              "lessThan": "c70994c2862b05e44728912b2ea9487d31e2aea7",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "45919fbfe1c487c17ea1d198534339a5e8abeae3",
              "lessThan": "7e7fff51808237703a3a1df6dd5cae1dfd1db86d",
              "versionType": "git"
            }
          ],
          "programFiles": [
            "drivers/block/null_blk/main.c"
          ],
          "defaultStatus": "unaffected"
        },
        {
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "product": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.5"
            },
            {
              "status": "unaffected",
              "version": "0",
              "lessThan": "5.5",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "6.1.188",
              "versionType": "semver",
              "lessThanOrEqual": "6.1.*"
            },
            {
              "status": "unaffected",
              "version": "6.6.157",
              "versionType": "semver",
              "lessThanOrEqual": "6.6.*"
            },
            {
              "status": "unaffected",
              "version": "6.12.110",
              "versionType": "semver",
              "lessThanOrEqual": "6.12.*"
            },
            {
              "status": "unaffected",
              "version": "6.18.52",
              "versionType": "semver",
              "lessThanOrEqual": "6.18.*"
            },
            {
              "status": "unaffected",
              "version": "7.2.6",
              "versionType": "semver",
              "lessThanOrEqual": "7.2.*"
            },
            {
              "status": "unaffected",
              "version": "7.3-rc1",
              "versionType": "original_commit_for_fix",
              "lessThanOrEqual": "*"
            }
          ],
          "programFiles": [
            "drivers/block/null_blk/main.c"
          ],
          "defaultStatus": "affected"
        }
      ]
    }
  ],
  "published": "2026-09-17T17:17:12.980",
  "references": [
    {
      "url": "https://git.kernel.org/stable/c/3945ce8cbce4e328e6fdf0b522dc71e340de19db",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/65cae82fd3c39b53430672cb9e3ecd267471a6ce",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/7e7fff51808237703a3a1df6dd5cae1dfd1db86d",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/88d806d0e1d36246208386a8e55b511c1b3d647c",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/8e839ed5210399a0330a8a6c5885c1d40a537c6d",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/c70994c2862b05e44728912b2ea9487d31e2aea7",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    }
  ],
  "vulnStatus": "Received",
  "descriptions": [
    {
      "lang": "en",
      "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnull_blk: serialize configfs attribute stores with the lock\n\nThe NULLB_DEVICE_ATTR _store takes no lock: apply_fn attributes\n(submit_queues, poll_queues) get dev->NAME written again after apply_fn\nreturns, outside its lock; APPLY=NULL attributes are entirely lockless.\nconfigfs only serializes stores per-open-file, so concurrent stores on\nseparate fds race.\n\nFor apply_fn attributes, once one store's apply_fn has reconfigured the\nhardware, a second (losing) store can still overwrite dev->NAME\nafterwards. This leaves dev->submit_queues out of sync with the live\nqueue count, which is later caught by the WARN_ON_ONCE() in\nnull_map_queues().\n\nFor !apply_fn attributes, power_store()'s null_add_dev() validates and\nbuilds the device under \"lock\" but only sets CONFIGURED afterwards. A store\nslipping in during this window can change a field mid-setup -- for example,\nzone_nr_conv can be pushed above nr_zones after it has already been\nclamped, leading to an out-of-bounds dev->zones[] access.\n\nTake \"lock\" in the macro around the apply_fn call, the CONFIGURED test and\nthe field write, and move it out of nullb_apply_submit_queues()/\nnullb_apply_poll_queues() so both paths are covered once. This serializes\nstores with power_store's setup and with each other."
    }
  ],
  "lastModified": "2026-09-17T17:17:12.980",
  "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}