---
id: CVE-2026-90185
title: |-
  In the Linux kernel, the following vulnerability has been resolved:

  null_blk: serialize configfs attribute stores with the lock

  The NULLB_DEVICE_ATTR _store takes no lock: apply_fn attributes
  (submit_queues, poll_queues) get dev->NAME …
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  null_blk: serialize configfs attribute stores with the lock

  The NULLB_DEVICE_ATTR _store takes no lock: apply_fn attributes
  (submit_queues, poll_queues) get dev->NAME …
severity: medium
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 45919fbfe1c487c17ea1d198534339a5e8abeae3 <
    8e839ed5210399a0330a8a6c5885c1d40a537c6d
  - >-
    Linux >= 45919fbfe1c487c17ea1d198534339a5e8abeae3 <
    88d806d0e1d36246208386a8e55b511c1b3d647c
  - >-
    Linux >= 45919fbfe1c487c17ea1d198534339a5e8abeae3 <
    3945ce8cbce4e328e6fdf0b522dc71e340de19db
  - >-
    Linux >= 45919fbfe1c487c17ea1d198534339a5e8abeae3 <
    65cae82fd3c39b53430672cb9e3ecd267471a6ce
  - >-
    Linux >= 45919fbfe1c487c17ea1d198534339a5e8abeae3 <
    c70994c2862b05e44728912b2ea9487d31e2aea7
  - >-
    Linux >= 45919fbfe1c487c17ea1d198534339a5e8abeae3 <
    7e7fff51808237703a3a1df6dd5cae1dfd1db86d
  - Linux 5.5
published: '2026-09-17'
updated: '2026-09-17'
sourceUpdated: '2026-09-17T17:17:12.980'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-90185'
references:
  - url: 'https://git.kernel.org/stable/c/3945ce8cbce4e328e6fdf0b522dc71e340de19db'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/65cae82fd3c39b53430672cb9e3ecd267471a6ce'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/7e7fff51808237703a3a1df6dd5cae1dfd1db86d'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/88d806d0e1d36246208386a8e55b511c1b3d647c'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/8e839ed5210399a0330a8a6c5885c1d40a537c6d'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/c70994c2862b05e44728912b2ea9487d31e2aea7'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: >-
      https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-90185.json
  - url: 'https://access.redhat.com/security/cve/CVE-2026-90185'
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2536578'
  - url: 'https://www.cve.org/CVERecord?id=CVE-2026-90185'
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-90185'
  - url: >-
      https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-90185.mbox
  - url: 'https://kernelcve.org/list/?q=CVE-2026-90185'
tags:
  - nvd
  - cve.org
  - csaf
  - vex
  - red-hat
ingestedAt: '2026-09-17T16:21:47.865Z'
epss: 0.00206
epssPercentile: 0.10511
cvss: 4.7
cvssVector: 'CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H'
cvssSource: vendor
cwe:
  - CWE-787
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

null_blk: serialize configfs attribute stores with the lock

The NULLB_DEVICE_ATTR _store takes no lock: apply_fn attributes
(submit_queues, poll_queues) get dev->NAME written again after apply_fn
returns, outside its lock; APPLY=NULL attributes are entirely lockless.
configfs only serializes stores per-open-file, so concurrent stores on
separate fds race.

For apply_fn attributes, once one store's apply_fn has reconfigured the
hardware, a second (losing) store can still overwrite dev->NAME
afterwards. This leaves dev->submit_queues out of sync with the live
queue count, which is later caught by the WARN_ON_ONCE() in
null_map_queues().

For !apply_fn attributes, power_store()'s null_add_dev() validates and
builds the device under "lock" but only sets CONFIGURED afterwards. A store
slipping in during this window can change a field mid-setup -- for example,
zone_nr_conv can be pushed above nr_zones after it has already been
clamped, leading to an out-of-bounds dev->zones[] access.

Take "lock" in the macro around the apply_fn call, the CONFIGURED test and
the field write, and move it out of nullb_apply_submit_queues()/
nullb_apply_poll_queues() so both paths are covered once. This serializes
stores with power_store's setup and with each other.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

## Vendor advisories

- **Red Hat VEX** · Moderate · affected: Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 9, Red Hat OpenShift Container Platform 4 · no fix planned: Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 9, Red Hat OpenShift Container Platform 4 · updated 2026-10-21 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-90185.json)