{"api_version":"1","generated_at":"2026-09-21T11:57:11+00:00","cve":"CVE-2026-90181","urls":{"html":"https://cve.report/CVE-2026-90181","api":"https://cve.report/api/cve/CVE-2026-90181.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2026-90181","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2026-90181"},"summary":{"title":"ublk: avoid teardown retry loop on xarray allocation failure","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nublk: avoid teardown retry loop on xarray allocation failure\n\n__ublk_shmem_remove_ranges() removes matching maple tree ranges in\nbatches, but first stores each range into a temporary xarray so that the\npages can be unpinned after dropping the maple tree lock.\n\nThat temporary xarray is filled under the maple tree lock with\nxa_store(..., GFP_ATOMIC). If the store fails before mas_erase(), the\ncurrent range is left in the tree and the helper returns false. The\nouter ublk_shmem_remove_ranges() loop then immediately retries the same\nrange. While the atomic allocation keeps failing, the teardown path has\nno forward progress.\n\nThe issue can be reproduced with radix_tree_node failslab injection after\na SHMEM_ZC buffer has already been registered:\n\n  # Kernel config:\n  #   CONFIG_BLK_DEV_UBLK=y\n  #   CONFIG_DEBUG_FS=y\n  #   CONFIG_FAULT_INJECTION=y\n  #   CONFIG_FAULT_INJECTION_DEBUG_FS=y\n  #   CONFIG_FAILSLAB=y\n\n  echo 10 > /proc/sys/vm/nr_hugepages\n  mkdir -p /tmp/htlb\n  mount -t hugetlbfs none /tmp/htlb\n  fallocate -l 4M /tmp/htlb/ublk_buf\n\n  dev_id=$(kublk add -t null --shmem_zc \\\n\t\t--htlb /tmp/htlb/ublk_buf |\n\t   awk -F '[ :]' '/dev id/ {print $3}')\n\n  echo 1 > /sys/kernel/slab/radix_tree_node/failslab\n  echo Y > /sys/kernel/debug/failslab/cache-filter\n  echo Y > /sys/kernel/debug/failslab/ignore-gfp-wait\n  echo 1 > /sys/kernel/debug/failslab/interval\n  echo -1 > /sys/kernel/debug/failslab/times\n  echo 100 > /sys/kernel/debug/failslab/probability\n\n  kublk del -n \"$dev_id\"\n\nOn the unfixed kernel the delete command was still running after 3\nseconds. Disabling failslab made it return. The fault-injection stack\nshowed:\n\n  should_failslab\n  kmem_cache_alloc_lru_noprof\n  __xas_nomem\n  __xa_store\n  xa_store\n  __ublk_shmem_remove_ranges\n  ublk_cdev_rel\n  ublk_ctrl_del_dev\n\nRemove the allocation from the teardown loop. Keep the existing batch\nlimit, but collect {base_pfn, nr_pages} pairs in a fixed-size stack array.\nOnce a matching range is found, the range is erased from the maple tree\nbefore dropping the lock, so each successful scan makes progress without\ndepending on any GFP_ATOMIC allocation.\n\nWith the same failslab settings, the fixed kernel completed\n\"kublk del -n $dev_id\" successfully in about 45 ms.","state":"PUBLISHED","assigner":"Linux","published_at":"2026-09-17 17:17:12","updated_at":"2026-09-17 17:17:12"},"problem_types":[],"metrics":[],"references":[{"url":"https://git.kernel.org/stable/c/4fd66a7f829f3f38f92a79081f0f2688aed644f0","name":"https://git.kernel.org/stable/c/4fd66a7f829f3f38f92a79081f0f2688aed644f0","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/b9cc6cc74daf6fef533dbe65d8cee779fea69600","name":"https://git.kernel.org/stable/c/b9cc6cc74daf6fef533dbe65d8cee779fea69600","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-90181","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-90181","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 309e02dccf64e1b7bd2067abedc270e33b0aadf3 b9cc6cc74daf6fef533dbe65d8cee779fea69600 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 309e02dccf64e1b7bd2067abedc270e33b0aadf3 4fd66a7f829f3f38f92a79081f0f2688aed644f0 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 7.1","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 7.1 semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 7.2.6 7.2.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 7.3-rc1 * original_commit_for_fix","platforms":[]}],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"cna":{"affected":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/block/ublk_drv.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"b9cc6cc74daf6fef533dbe65d8cee779fea69600","status":"affected","version":"309e02dccf64e1b7bd2067abedc270e33b0aadf3","versionType":"git"},{"lessThan":"4fd66a7f829f3f38f92a79081f0f2688aed644f0","status":"affected","version":"309e02dccf64e1b7bd2067abedc270e33b0aadf3","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/block/ublk_drv.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"7.1"},{"lessThan":"7.1","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"7.2.*","status":"unaffected","version":"7.2.6","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.3-rc1","versionType":"original_commit_for_fix"}]}],"cpeApplicability":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"7.2.6","versionStartIncluding":"7.1","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"7.3-rc1","versionStartIncluding":"7.1","vulnerable":true}],"negate":false,"operator":"OR"}]}],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nublk: avoid teardown retry loop on xarray allocation failure\n\n__ublk_shmem_remove_ranges() removes matching maple tree ranges in\nbatches, but first stores each range into a temporary xarray so that the\npages can be unpinned after dropping the maple tree lock.\n\nThat temporary xarray is filled under the maple tree lock with\nxa_store(..., GFP_ATOMIC). If the store fails before mas_erase(), the\ncurrent range is left in the tree and the helper returns false. The\nouter ublk_shmem_remove_ranges() loop then immediately retries the same\nrange. While the atomic allocation keeps failing, the teardown path has\nno forward progress.\n\nThe issue can be reproduced with radix_tree_node failslab injection after\na SHMEM_ZC buffer has already been registered:\n\n  # Kernel config:\n  #   CONFIG_BLK_DEV_UBLK=y\n  #   CONFIG_DEBUG_FS=y\n  #   CONFIG_FAULT_INJECTION=y\n  #   CONFIG_FAULT_INJECTION_DEBUG_FS=y\n  #   CONFIG_FAILSLAB=y\n\n  echo 10 > /proc/sys/vm/nr_hugepages\n  mkdir -p /tmp/htlb\n  mount -t hugetlbfs none /tmp/htlb\n  fallocate -l 4M /tmp/htlb/ublk_buf\n\n  dev_id=$(kublk add -t null --shmem_zc \\\n\t\t--htlb /tmp/htlb/ublk_buf |\n\t   awk -F '[ :]' '/dev id/ {print $3}')\n\n  echo 1 > /sys/kernel/slab/radix_tree_node/failslab\n  echo Y > /sys/kernel/debug/failslab/cache-filter\n  echo Y > /sys/kernel/debug/failslab/ignore-gfp-wait\n  echo 1 > /sys/kernel/debug/failslab/interval\n  echo -1 > /sys/kernel/debug/failslab/times\n  echo 100 > /sys/kernel/debug/failslab/probability\n\n  kublk del -n \"$dev_id\"\n\nOn the unfixed kernel the delete command was still running after 3\nseconds. Disabling failslab made it return. The fault-injection stack\nshowed:\n\n  should_failslab\n  kmem_cache_alloc_lru_noprof\n  __xas_nomem\n  __xa_store\n  xa_store\n  __ublk_shmem_remove_ranges\n  ublk_cdev_rel\n  ublk_ctrl_del_dev\n\nRemove the allocation from the teardown loop. Keep the existing batch\nlimit, but collect {base_pfn, nr_pages} pairs in a fixed-size stack array.\nOnce a matching range is found, the range is erased from the maple tree\nbefore dropping the lock, so each successful scan makes progress without\ndepending on any GFP_ATOMIC allocation.\n\nWith the same failslab settings, the fixed kernel completed\n\"kublk del -n $dev_id\" successfully in about 45 ms."}],"providerMetadata":{"dateUpdated":"2026-09-17T16:07:05.725Z","orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","shortName":"Linux"},"references":[{"url":"https://git.kernel.org/stable/c/b9cc6cc74daf6fef533dbe65d8cee779fea69600"},{"url":"https://git.kernel.org/stable/c/4fd66a7f829f3f38f92a79081f0f2688aed644f0"}],"title":"ublk: avoid teardown retry loop on xarray allocation failure","x_generator":{"engine":"bippy-1.2.0"}}},"cveMetadata":{"assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","assignerShortName":"Linux","cveId":"CVE-2026-90181","datePublished":"2026-09-17T16:07:05.725Z","dateReserved":"2026-09-11T19:38:34.791Z","dateUpdated":"2026-09-17T16:07:05.725Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.2"},"nvd":{"publishedDate":"2026-09-17 17:17:12","lastModifiedDate":"2026-09-17 17:17:12","problem_types":[],"metrics":[],"configurations":[]},"legacy_mitre":{"record":{"CveYear":"2026","CveId":"90181","Ordinal":"1","Title":"ublk: avoid teardown retry loop on xarray allocation failure","CVE":"CVE-2026-90181","Year":"2026"},"notes":[{"CveYear":"2026","CveId":"90181","Ordinal":"1","NoteData":"In the Linux kernel, the following vulnerability has been resolved:\n\nublk: avoid teardown retry loop on xarray allocation failure\n\n__ublk_shmem_remove_ranges() removes matching maple tree ranges in\nbatches, but first stores each range into a temporary xarray so that the\npages can be unpinned after dropping the maple tree lock.\n\nThat temporary xarray is filled under the maple tree lock with\nxa_store(..., GFP_ATOMIC). If the store fails before mas_erase(), the\ncurrent range is left in the tree and the helper returns false. The\nouter ublk_shmem_remove_ranges() loop then immediately retries the same\nrange. While the atomic allocation keeps failing, the teardown path has\nno forward progress.\n\nThe issue can be reproduced with radix_tree_node failslab injection after\na SHMEM_ZC buffer has already been registered:\n\n  # Kernel config:\n  #   CONFIG_BLK_DEV_UBLK=y\n  #   CONFIG_DEBUG_FS=y\n  #   CONFIG_FAULT_INJECTION=y\n  #   CONFIG_FAULT_INJECTION_DEBUG_FS=y\n  #   CONFIG_FAILSLAB=y\n\n  echo 10 > /proc/sys/vm/nr_hugepages\n  mkdir -p /tmp/htlb\n  mount -t hugetlbfs none /tmp/htlb\n  fallocate -l 4M /tmp/htlb/ublk_buf\n\n  dev_id=$(kublk add -t null --shmem_zc \\\n\t\t--htlb /tmp/htlb/ublk_buf |\n\t   awk -F '[ :]' '/dev id/ {print $3}')\n\n  echo 1 > /sys/kernel/slab/radix_tree_node/failslab\n  echo Y > /sys/kernel/debug/failslab/cache-filter\n  echo Y > /sys/kernel/debug/failslab/ignore-gfp-wait\n  echo 1 > /sys/kernel/debug/failslab/interval\n  echo -1 > /sys/kernel/debug/failslab/times\n  echo 100 > /sys/kernel/debug/failslab/probability\n\n  kublk del -n \"$dev_id\"\n\nOn the unfixed kernel the delete command was still running after 3\nseconds. Disabling failslab made it return. The fault-injection stack\nshowed:\n\n  should_failslab\n  kmem_cache_alloc_lru_noprof\n  __xas_nomem\n  __xa_store\n  xa_store\n  __ublk_shmem_remove_ranges\n  ublk_cdev_rel\n  ublk_ctrl_del_dev\n\nRemove the allocation from the teardown loop. Keep the existing batch\nlimit, but collect {base_pfn, nr_pages} pairs in a fixed-size stack array.\nOnce a matching range is found, the range is erased from the maple tree\nbefore dropping the lock, so each successful scan makes progress without\ndepending on any GFP_ATOMIC allocation.\n\nWith the same failslab settings, the fixed kernel completed\n\"kublk del -n $dev_id\" successfully in about 45 ms.","Type":"Description","Title":"ublk: avoid teardown retry loop on xarray allocation failure"}]}}}