CVE-2026-90184

CVE-2026-90184 is a race condition in the Linux kernel's null_blk block device driver. Configfs attribute store methods (e.g., for zoned) run concurrently with null_add_dev() without holding a lock, allowing device configuration to change mid-setup. This can lead to a failed device setup (-EIO vi...

CVE-2026-90184 null_blk: serialize configfs attribute updates with device setup

In the Linux kernel, the following vulnerability has been resolved: nullblk: serialize configfs attribute updates with device setup The attribute store methods generated with NULLBDEVICEATTR refuse to change the configuration of a live device by testing NULLBDEVFLCONFIGURED, but that flag is only...

EUVD-2026-81777

In the Linux kernel, the following vulnerability has been resolved: nullblk: serialize configfs attribute updates with device setup The attribute store methods generated with NULLBDEVICEATTR refuse to change the configuration of a live device by testing NULLBDEVFLCONFIGURED, but that flag is only...

CVE-2026-90185: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: nullblk: serialize configfs attribute stores with the lock The NULLBDEVICEATTR store takes no lock: applyfn attributes submitqueues, pollqueues get dev-NAME written again after applyfn returns, outside its lock; APPLY=NULL...

CVE-2026-90184: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: nullblk: serialize configfs attribute updates with device setup The attribute store methods generated with NULLBDEVICEATTR refuse to change the configuration of a live device by testing NULLBDEVFLCONFIGURED, but that flag is only...

CVE-2026-93056: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: fuac1legacy: remove broken string configfs attributes The UAC1STRATTRIBUTE macro defines configfs show/store handlers for the fnplay, fncap, and fncntl string options. The store function contains an inverted null che...

CVE-2026-90190: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: nullblk: use DEFINEMUTEX for the file-scope mutex In nullinit, mutexinit&lock currently happens after configfsregistersubsystem, which exposes the nullb subsystem to userspace. A racing mkdir into /sys/kernel/config/nullb/ can...

PT-2026-94918

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An array-index-out-of-bounds issue exists in the UAC1 and UAC2 configfs rate-list attributes. The system parses a comma-separated list of sampling rates and stores them in fixed-size...

PT-2026-94538

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description In the null blk component, a race condition exists during initialization. The mutex init&lock function is called after configfs register subsystem, which exposes the nullb subsystem to...

PT-2026-94533

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the null blk driver where configfs attribute stores are not properly serialized with a lock. This occurs because the NULLB DEVICE ATTR store does not utilize a lock,...

PT-2026-94534

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the null blk driver where resizing submit queues or poll queues via configfs on a device with shared tags enabled can lead to a kernel crash. When a shared tag set is...

CVE-2026-90186: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: nullblk: reject per-device queue resize for shared tag set When sharedtags is enabled, nullsetuptagset makes the device use the global tagset, whose driverdata stays NULL. nullmapqueues therefore falls back to the module-wide...

PT-2026-94537

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the null blk driver where configfs register subsystem is called before register blkdev in the null init function. When null blk is used as a module, a race condition...

PT-2026-94916

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An out-of-bounds read exists in the usb gadget configfs component. The function os desc qw sign show incorrectly uses OS STRING QW SIGN LEN as the input length for utf16s to utf8s. Becau...

CVE-2026-90189: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: nullblk: register configfs subsystem after creating default devices In nullinit, configfsregistersubsystem currently runs before registerblkdev, so when nullblk is built as a module, a racing mkdir + poweron from userspace can...

CVE-2026-93122: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: uac: validate rate list length before storing UAC1 and UAC2 configfs rate-list attributes parse a comma-separated list of sampling rates and store each parsed value in fixed-size arrays. The arrays have UACMAXRATES...

CVE-2026-93120: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: configfs: fix out-of-bounds read of qwsign osdescqwsignshow passes OSSTRINGQWSIGNLEN as the input length to utf16stoutf8s, but that argument counts UTF-16 code units while OSSTRINGQWSIGNLEN 14 is the byte size of...

CVE-2026-90301: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: ocfs2: o2hb: quiesce negotiate handlers and timeout work Heartbeat regions publish struct o2hbregion as the private data for the NEGOTIMEOUT and NEGOAPPROVE o2net handlers as soon as makeitem creates the configfs region. The...

CVE-2026-90206: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: nvmet: fix maxqid race between configfs and controller allocation The function nvmetsubsysattrqidmaxstore can race against nvmetallocctrl when a subsystem's maxqid limit is modified. Suppose maxqid is currently 64. If...

CVE-2026-90187: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: nullblk: free zones array on device power-off nullinitzoneddev allocates dev-zones when a zoned device is powered on, but nulldeldev never frees it on power-off; dev-zones is only freed later in nullfreedev, when the configfs...