CVE-2026-90186

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

null_blk: reject per-device queue resize for shared tag set

When shared_tags is enabled, null_setup_tagset() makes the device use the

global tag_set, whose driver_data stays NULL. null_map_queues() therefore

falls back to the module-wide g_submit_queues/g_poll_queues instead of any

per-device value.

Resizing submit_queues or poll_queues via configfs on such a device calls

blk_mq_update_nr_hw_queues() on the shared set, shrinking

set->nr_hw_queues. __blk_mq_realloc_hw_ctxs() only grows the

q->queue_hw_ctx[] allocation, so on shrink it merely exits and NULLs the

now-excess hctx slots. null_map_queues(), however, keeps mapping CPUs with

the unchanged g_submit_queues/g_poll_queues, so mq_map[] ends up pointing

at those NULLed hctx slots. blk_mq_map_swqueue() then dereferences the NULL

hctx (hctx->cpumask), crashing the kernel:

[ 460.218374] KASAN: null-ptr-deref in range [0x0000000000000098-0x000000000000009f]

[ 460

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References