{"id":"CVE-2026-90181","summary":"ublk: avoid teardown retry loop on xarray allocation failure","details":"In the Linux kernel, the following vulnerability has been resolved:\n\nublk: avoid teardown retry loop on xarray allocation failure\n\n__ublk_shmem_remove_ranges() removes matching maple tree ranges in\nbatches, but first stores each range into a temporary xarray so that the\npages can be unpinned after dropping the maple tree lock.\n\nThat temporary xarray is filled under the maple tree lock with\nxa_store(..., GFP_ATOMIC). If the store fails before mas_erase(), the\ncurrent range is left in the tree and the helper returns false. The\nouter ublk_shmem_remove_ranges() loop then immediately retries the same\nrange. While the atomic allocation keeps failing, the teardown path has\nno forward progress.\n\nThe issue can be reproduced with radix_tree_node failslab injection after\na SHMEM_ZC buffer has already been registered:\n\n  # Kernel config:\n  #   CONFIG_BLK_DEV_UBLK=y\n  #   CONFIG_DEBUG_FS=y\n  #   CONFIG_FAULT_INJECTION=y\n  #   CONFIG_FAULT_INJECTION_DEBUG_FS=y\n  #   CONFIG_FAILSLAB=y\n\n  echo 10 \u003e /proc/sys/vm/nr_hugepages\n  mkdir -p /tmp/htlb\n  mount -t hugetlbfs none /tmp/htlb\n  fallocate -l 4M /tmp/htlb/ublk_buf\n\n  dev_id=$(kublk add -t null --shmem_zc \\\n\t\t--htlb /tmp/htlb/ublk_buf |\n\t   awk -F '[ :]' '/dev id/ {print $3}')\n\n  echo 1 \u003e /sys/kernel/slab/radix_tree_node/failslab\n  echo Y \u003e /sys/kernel/debug/failslab/cache-filter\n  echo Y \u003e /sys/kernel/debug/failslab/ignore-gfp-wait\n  echo 1 \u003e /sys/kernel/debug/failslab/interval\n  echo -1 \u003e /sys/kernel/debug/failslab/times\n  echo 100 \u003e /sys/kernel/debug/failslab/probability\n\n  kublk del -n \"$dev_id\"\n\nOn the unfixed kernel the delete command was still running after 3\nseconds. Disabling failslab made it return. The fault-injection stack\nshowed:\n\n  should_failslab\n  kmem_cache_alloc_lru_noprof\n  __xas_nomem\n  __xa_store\n  xa_store\n  __ublk_shmem_remove_ranges\n  ublk_cdev_rel\n  ublk_ctrl_del_dev\n\nRemove the allocation from the teardown loop. Keep the existing batch\nlimit, but collect {base_pfn, nr_pages} pairs in a fixed-size stack array.\nOnce a matching range is found, the range is erased from the maple tree\nbefore dropping the lock, so each successful scan makes progress without\ndepending on any GFP_ATOMIC allocation.\n\nWith the same failslab settings, the fixed kernel completed\n\"kublk del -n $dev_id\" successfully in about 45 ms.","modified":"2026-09-18T03:48:36.181944892Z","published":"2026-09-17T16:07:05.725Z","database_specific":{"cna_assigner":"Linux","osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/90xxx/CVE-2026-90181.json"},"references":[{"type":"PACKAGE","url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git"},{"type":"WEB","url":"https://git.kernel.org/stable/c/4fd66a7f829f3f38f92a79081f0f2688aed644f0"},{"type":"WEB","url":"https://git.kernel.org/stable/c/b9cc6cc74daf6fef533dbe65d8cee779fea69600"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/90xxx/CVE-2026-90181.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-90181"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","events":[{"introduced":"309e02dccf64e1b7bd2067abedc270e33b0aadf3"},{"fixed":"b9cc6cc74daf6fef533dbe65d8cee779fea69600"},{"fixed":"4fd66a7f829f3f38f92a79081f0f2688aed644f0"}]}],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-90181.json"}},{"package":{"name":"Kernel","ecosystem":"Linux"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.1.0"},{"fixed":"7.2.6"}]}],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-90181.json"}}],"schema_version":"1.9.0"}