CVE-2026-90190

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

null_blk: use DEFINE_MUTEX for the file-scope mutex

In null_init(), mutex_init(&lock) currently happens after

configfs_register_subsystem(), which exposes the nullb subsystem to

userspace. A racing mkdir() into /sys/kernel/config/nullb/ can reach

null_find_dev_by_name() -> mutex_lock(&lock) before the mutex is

initialized, trigger warning:

[ 123.137788] DEBUG_LOCKS_WARN_ON(lock->magic != lock)

[ 123.137796] WARNING: kernel/locking/mutex.c:159 at mutex_lock+0x171/0x1c0, CPU#13: mkdir/1301

[ 123.140090] Modules linked in: null_blk(+) nft_fib_inet nft_fib_ipv4

......

[ 123.154926] Call Trace:

[ 123.155172] <TASK>

[ 123.155419] ? __pfx_mutex_lock+0x10/0x10

[ 123.156181] ? __pfx__raw_spin_lock+0x10/0x10

[ 123.156571] nullb_group_make_group+0x20/0x100 [null_blk]

[ 123.157011] configfs_mkdir+0x47b/0xc70

[ 123.157337] ? __pfx_configfs_mkdir+0x10/0x10

[ 123.157719] ? may_create_dentry+0x242/0x2e0

[ 123.158

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References