CVE-2026-90181

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

ublk: avoid teardown retry loop on xarray allocation failure

__ublk_shmem_remove_ranges() removes matching maple tree ranges in

batches, but first stores each range into a temporary xarray so that the

pages can be unpinned after dropping the maple tree lock.

That temporary xarray is filled under the maple tree lock with

xa_store(..., GFP_ATOMIC). If the store fails before mas_erase(), the

current range is left in the tree and the helper returns false. The

outer ublk_shmem_remove_ranges() loop then immediately retries the same

range. While the atomic allocation keeps failing, the teardown path has

no forward progress.

The issue can be reproduced with radix_tree_node failslab injection after

a SHMEM_ZC buffer has already been registered:

# Kernel config:

# CONFIG_BLK_DEV_UBLK=y

# CONFIG_DEBUG_FS=y

# CONFIG_FAULT_INJECTION=y

# CONFIG_FAULT_INJECTION_DEBUG_FS=y

# CONFIG_FAILSLAB=y

echo 10 > /p

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References