{"id":"CVE-2026-90184","summary":"null_blk: serialize configfs attribute updates with device setup","details":"In the Linux kernel, the following vulnerability has been resolved:\n\nnull_blk: serialize configfs attribute updates with device setup\n\nThe attribute store methods generated with NULLB_DEVICE_ATTR() refuse to\nchange the configuration of a live device by testing\nNULLB_DEV_FL_CONFIGURED, but that flag is only set by\nnullb_device_power_store() after null_add_dev() has returned, and the\nstore methods take no lock at all. configfs only serializes writes to\nthe same open file (buffer-\u003emutex), so a write to any attribute can run\nconcurrently with null_add_dev() and change the device configuration\nwhile it is being used.\n\nnull_add_dev() reads the configuration several times, e.g. dev-\u003ezoned is\nread once to set up the queue limits and once to initialize the zone\nresources:\n\n  CPU0: echo 1 \u003e nullb0/power         CPU1: echo 1 \u003e nullb0/zoned\n  nullb_device_power_store()\n    mutex_lock(&lock)\n    null_add_dev()\n      if (dev-\u003ezoned) -\u003e false\n        /* no BLK_FEAT_ZONED */       nullb_device_zoned_store()\n                                        test_bit(FL_CONFIGURED) -\u003e 0\n                                        dev-\u003ezoned = true\n      blk_mq_alloc_disk()\n        /* queue is not zoned */\n      if (nullb-\u003edev-\u003ezoned) -\u003e true\n        null_register_zoned_dev()\n          blk_revalidate_disk_zones()\n\nblk_revalidate_disk_zones() is then called for a queue that does not\nhave BLK_FEAT_ZONED set, which triggers its WARN_ON_ONCE() and fails the\ndevice setup with -EIO:\n\n  WARNING: CPU: 2 PID: 322 at block/blk-zoned.c:2357 blk_revalidate_disk_zones+0x4c/0x560\n\nClearing dev-\u003ezoned in the same window is worse: the queue is created\nwith BLK_FEAT_ZONED but the zone resources are never initialized, so\nadd_disk() succeeds for a zoned disk that has no zones. And a store that\nlands after the last dev-\u003ezoned test leaves dev-\u003ezoned set while\ndev-\u003ezones is still NULL, which null_process_zoned_cmd() dereferences on\nthe first write.\n\nFix this by taking the global lock, which nullb_device_power_store()\nalready holds across null_add_dev() and null_del_dev(), around both the\nNULLB_DEV_FL_CONFIGURED test and the update of the device configuration.\nThe submit_queues and poll_queues apply callbacks are now called with\nthat lock held, so remove the locking they did themselves.\n\nSince the store methods can run as soon as configfs_register_subsystem()\nreturns, that is, before null_init() gets to mutex_init(&lock), also\ninitialize the lock statically with DEFINE_MUTEX().","modified":"2026-09-18T03:48:36.297906976Z","published":"2026-09-17T16:07:07.728Z","database_specific":{"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/90xxx/CVE-2026-90184.json","cna_assigner":"Linux"},"references":[{"type":"PACKAGE","url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git"},{"type":"WEB","url":"https://git.kernel.org/stable/c/32456a85995579e56c60cc53c357cda75a9d4f7c"},{"type":"WEB","url":"https://git.kernel.org/stable/c/4e1f23f9c33c156be7e313b40695af5a3a834739"},{"type":"WEB","url":"https://git.kernel.org/stable/c/6352e7ead2d8111802a554eeb94886f5a9894bb9"},{"type":"WEB","url":"https://git.kernel.org/stable/c/7de792b4c48fba02a36a8077032f7d5093c925e5"},{"type":"WEB","url":"https://git.kernel.org/stable/c/aed8af338a09a64d63b068a803c4ecfc5701dd4c"},{"type":"WEB","url":"https://git.kernel.org/stable/c/d3d35dd045a35991bf6fd13de5f293e6dd7bf3b3"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/90xxx/CVE-2026-90184.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-90184"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","events":[{"introduced":"3bf2bd20734e3e6ffda53719a9c10fb3ee9c5ffa"},{"fixed":"6352e7ead2d8111802a554eeb94886f5a9894bb9"},{"fixed":"7de792b4c48fba02a36a8077032f7d5093c925e5"},{"fixed":"aed8af338a09a64d63b068a803c4ecfc5701dd4c"},{"fixed":"32456a85995579e56c60cc53c357cda75a9d4f7c"},{"fixed":"d3d35dd045a35991bf6fd13de5f293e6dd7bf3b3"},{"fixed":"4e1f23f9c33c156be7e313b40695af5a3a834739"}]}],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-90184.json"}},{"package":{"name":"Kernel","ecosystem":"Linux"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.14.0"},{"fixed":"6.1.188"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.2.0"},{"fixed":"6.6.157"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.7.0"},{"fixed":"6.12.110"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.13.0"},{"fixed":"6.18.52"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.19.0"},{"fixed":"7.2.6"}]}],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-90184.json"}}],"schema_version":"1.9.0"}