CVE-2026-90184

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

null_blk: serialize configfs attribute updates with device setup

The attribute store methods generated with NULLB_DEVICE_ATTR() refuse to

change the configuration of a live device by testing

NULLB_DEV_FL_CONFIGURED, but that flag is only set by

nullb_device_power_store() after null_add_dev() has returned, and the

store methods take no lock at all. configfs only serializes writes to

the same open file (buffer->mutex), so a write to any attribute can run

concurrently with null_add_dev() and change the device configuration

while it is being used.

null_add_dev() reads the configuration several times, e.g. dev->zoned is

read once to set up the queue limits and once to initialize the zone

resources:

CPU0: echo 1 > nullb0/power CPU1: echo 1 > nullb0/zoned

nullb_device_power_store()

mutex_lock(&lock)

null_add_dev()

if (dev->zoned) -> false

/* no BLK_FEAT_ZONED */ nullb_device_zoned_s

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References