CVE-2026-90185

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

null_blk: serialize configfs attribute stores with the lock

The NULLB_DEVICE_ATTR _store takes no lock: apply_fn attributes

(submit_queues, poll_queues) get dev->NAME written again after apply_fn

returns, outside its lock; APPLY=NULL attributes are entirely lockless.

configfs only serializes stores per-open-file, so concurrent stores on

separate fds race.

For apply_fn attributes, once one store's apply_fn has reconfigured the

hardware, a second (losing) store can still overwrite dev->NAME

afterwards. This leaves dev->submit_queues out of sync with the live

queue count, which is later caught by the WARN_ON_ONCE() in

null_map_queues().

For !apply_fn attributes, power_store()'s null_add_dev() validates and

builds the device under "lock" but only sets CONFIGURED afterwards. A store

slipping in during this window can change a field mid-setup -- for example,

zone_nr_conv can be pushed above nr_zones after it has already

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References