CVE-2026-90229

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

nvme-apple: Destroy the admin queue on removal

The admin queue is allocated with blk_mq_alloc_queue() but never

destroyed. nvme_free_ctrl() only drops the last reference and

blk_mq_exit_queue() and blk_sync_queue() never run: the hctx is never

moved to q->unused_hctx_list and the timeout timer and work stay armed on

a queue that is about to be freed which will eventually oops inside

blk_mq_timeout_work().

This can only be triggered when the controller fails to come up and is

then immediately torn down again which is why no one ever ran into this

before.

Let's just copy what the pcie driver does: unquiesce and destroy the admin

queue before nvme_uninit_ctrl().

With this the following WARN followed by a panic no longer happens:

WARNING: block/blk-mq.c:4390 at blk_mq_release+0x194/0x238, CPU#4: kworker/u34:4/119

CPU: 4 UID: 0 PID: 119 Comm: kworker/u34:4 Not tainted 7.2.0-rc1-dirty #248 PREEMPT

Hardware name:

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References