{"id":"AZL-102242","summary":"CVE-2026-90188 affecting package kernel 6.6.150.1-1","details":"In the Linux kernel, the following vulnerability has been resolved:\n\nnull_blk: free global tag_set on init error path\n\nIf shared_tags is enabled, null_setup_tagset() allocates the global tag_set\nvia null_init_global_tag_set(). If device creation later fails, err_dev\ndestroys the default devices and calls unregister_blkdev(), but never frees\nthe global tag_set. Since module init failed, null_exit() is never invoked,\nso the global tag_set's tags and maps are permanently leaked.\n\nFree the global tag_set in err_dev, matching null_exit() which does\nif (tag_set.ops) blk_mq_free_tag_set(&tag_set).","modified":"2026-09-18T14:17:49.948962128Z","published":"2026-09-17T17:17:13Z","upstream":["CVE-2026-90188"],"references":[{"type":"WEB","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-90188"}],"affected":[{"package":{"name":"kernel","ecosystem":"Azure Linux:3","purl":"pkg:rpm/azure-linux/kernel"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"6.6.150.1-1"}]}],"database_specific":{"source":"https://github.com/microsoft/AzureLinuxVulnerabilityData/blob/main/osv/AZL-102242.json"}}],"schema_version":"1.9.0"}