{"api_version":"1","generated_at":"2026-09-21T16:15:55+00:00","cve":"CVE-2026-90189","urls":{"html":"https://cve.report/CVE-2026-90189","api":"https://cve.report/api/cve/CVE-2026-90189.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2026-90189","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2026-90189"},"summary":{"title":"null_blk: register configfs subsystem after creating default devices","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nnull_blk: register configfs subsystem after creating default devices\n\nIn null_init(), configfs_register_subsystem() currently runs before\nregister_blkdev(), so when null_blk is built as a module, a racing mkdir()\n+ poweron from userspace can reach null_add_dev() while null_major is still\n0. __add_disk() then hits WARN_ON(disk->minors) (major=0 with minors!=0)\nand fails:\n\n[root@fedora ~]# [ 2366.521436] WARNING: block/genhd.c:476 at __add_disk+0x8a7/0xde0,\n[ 2366.523552] Modules linked in: null_blk(+) nft_fib_inet nft_fib_ipv4 nft_fib_ipv6 nft_fib\n[ 2366.529081] CPU: 26 UID: 0 PID: 1600 Comm: sh Not tainted 7.2.0-rc1+ #66 PREEMPT(full)\n......\n[ 2366.547251] Call Trace:\n[ 2366.547575]  <TASK>\n[ 2366.547831]  ? _raw_spin_lock+0x84/0xe0\n[ 2366.548260]  add_disk_fwnode+0x114/0x560\n[ 2366.548739]  null_add_dev+0x102d/0x1b80 [null_blk]\n[ 2366.549310]  ? __pfx_null_add_dev+0x10/0x10 [null_blk]\n[ 2366.549906]  ? mutex_lock+0xde/0x1c0\n[ 2366.550361]  ? __pfx_mutex_lock+0x10/0x10\n[ 2366.550827]  nullb_device_power_store+0x1e7/0x280 [null_blk]\n[ 2366.551499]  ? __pfx_nullb_device_power_store+0x10/0x10 [null_blk]\n[ 2366.552177]  ? __kmalloc_cache_noprof+0x1f5/0x470\n[ 2366.552748]  ? configfs_write_iter+0x35c/0x4e0\n[ 2366.553242]  configfs_write_iter+0x286/0x4e0\n[ 2366.553787]  vfs_write+0x52d/0xd00\n[ 2366.554169]  ? __pfx_vfs_write+0x10/0x10\n[ 2366.554679]  ? __pfx___css_rstat_updated+0x10/0x10\n[ 2366.555196]  ? fdget_pos+0x1cf/0x4c0\n[ 2366.555649]  ksys_write+0xfc/0x1d0\n......\n\nAdditionally, the err_dev path destroys all devices on nullb_list while\nconfigfs is still registered. If a racing mkdir() + poweron puts a user\ndevice on the list, null_destroy_dev()->null_free_dev() kfrees the user\ndevice's nullb_device but /sys/kernel/config/nullb/<name> is still\nreachable. Any userspace access to the item will trigger a UAF.\n\nFor simplicity, move configfs_register_subsystem() to the end to solve\nthe problems above.","state":"PUBLISHED","assigner":"Linux","published_at":"2026-09-17 17:17:13","updated_at":"2026-09-17 17:17:13"},"problem_types":[],"metrics":[],"references":[{"url":"https://git.kernel.org/stable/c/d761be1b8f2bbabc41252deb79a426d3f0d4fa10","name":"https://git.kernel.org/stable/c/d761be1b8f2bbabc41252deb79a426d3f0d4fa10","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/2679b11e9256bd70a5ef41783bab6ad6c34a3db1","name":"https://git.kernel.org/stable/c/2679b11e9256bd70a5ef41783bab6ad6c34a3db1","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/57debc907aef66319d244009d3370dcd97388d37","name":"https://git.kernel.org/stable/c/57debc907aef66319d244009d3370dcd97388d37","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/dbcedbe4819ae21274ea77469e61e46a878b9943","name":"https://git.kernel.org/stable/c/dbcedbe4819ae21274ea77469e61e46a878b9943","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/cab9bf5f68f76cd44e0ec92bd4a60c9b83656a36","name":"https://git.kernel.org/stable/c/cab9bf5f68f76cd44e0ec92bd4a60c9b83656a36","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/c9d293d6bb0575fcb1f3408129453187e2a28a4e","name":"https://git.kernel.org/stable/c/c9d293d6bb0575fcb1f3408129453187e2a28a4e","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-90189","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-90189","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 3bf2bd20734e3e6ffda53719a9c10fb3ee9c5ffa 2679b11e9256bd70a5ef41783bab6ad6c34a3db1 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 3bf2bd20734e3e6ffda53719a9c10fb3ee9c5ffa dbcedbe4819ae21274ea77469e61e46a878b9943 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 3bf2bd20734e3e6ffda53719a9c10fb3ee9c5ffa 57debc907aef66319d244009d3370dcd97388d37 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 3bf2bd20734e3e6ffda53719a9c10fb3ee9c5ffa d761be1b8f2bbabc41252deb79a426d3f0d4fa10 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 3bf2bd20734e3e6ffda53719a9c10fb3ee9c5ffa cab9bf5f68f76cd44e0ec92bd4a60c9b83656a36 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 3bf2bd20734e3e6ffda53719a9c10fb3ee9c5ffa c9d293d6bb0575fcb1f3408129453187e2a28a4e git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 4.14","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 4.14 semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 6.1.188 6.1.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 6.6.157 6.6.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 6.12.110 6.12.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 6.18.52 6.18.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 7.2.6 7.2.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 7.3-rc1 * original_commit_for_fix","platforms":[]}],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"cna":{"affected":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/block/null_blk/main.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"2679b11e9256bd70a5ef41783bab6ad6c34a3db1","status":"affected","version":"3bf2bd20734e3e6ffda53719a9c10fb3ee9c5ffa","versionType":"git"},{"lessThan":"dbcedbe4819ae21274ea77469e61e46a878b9943","status":"affected","version":"3bf2bd20734e3e6ffda53719a9c10fb3ee9c5ffa","versionType":"git"},{"lessThan":"57debc907aef66319d244009d3370dcd97388d37","status":"affected","version":"3bf2bd20734e3e6ffda53719a9c10fb3ee9c5ffa","versionType":"git"},{"lessThan":"d761be1b8f2bbabc41252deb79a426d3f0d4fa10","status":"affected","version":"3bf2bd20734e3e6ffda53719a9c10fb3ee9c5ffa","versionType":"git"},{"lessThan":"cab9bf5f68f76cd44e0ec92bd4a60c9b83656a36","status":"affected","version":"3bf2bd20734e3e6ffda53719a9c10fb3ee9c5ffa","versionType":"git"},{"lessThan":"c9d293d6bb0575fcb1f3408129453187e2a28a4e","status":"affected","version":"3bf2bd20734e3e6ffda53719a9c10fb3ee9c5ffa","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/block/null_blk/main.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"4.14"},{"lessThan":"4.14","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.188","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.157","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.110","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.52","versionType":"semver"},{"lessThanOrEqual":"7.2.*","status":"unaffected","version":"7.2.6","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.3-rc1","versionType":"original_commit_for_fix"}]}],"cpeApplicability":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"6.1.188","versionStartIncluding":"4.14","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"6.6.157","versionStartIncluding":"4.14","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"6.12.110","versionStartIncluding":"4.14","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"6.18.52","versionStartIncluding":"4.14","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"7.2.6","versionStartIncluding":"4.14","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"7.3-rc1","versionStartIncluding":"4.14","vulnerable":true}],"negate":false,"operator":"OR"}]}],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nnull_blk: register configfs subsystem after creating default devices\n\nIn null_init(), configfs_register_subsystem() currently runs before\nregister_blkdev(), so when null_blk is built as a module, a racing mkdir()\n+ poweron from userspace can reach null_add_dev() while null_major is still\n0. __add_disk() then hits WARN_ON(disk->minors) (major=0 with minors!=0)\nand fails:\n\n[root@fedora ~]# [ 2366.521436] WARNING: block/genhd.c:476 at __add_disk+0x8a7/0xde0,\n[ 2366.523552] Modules linked in: null_blk(+) nft_fib_inet nft_fib_ipv4 nft_fib_ipv6 nft_fib\n[ 2366.529081] CPU: 26 UID: 0 PID: 1600 Comm: sh Not tainted 7.2.0-rc1+ #66 PREEMPT(full)\n......\n[ 2366.547251] Call Trace:\n[ 2366.547575]  <TASK>\n[ 2366.547831]  ? _raw_spin_lock+0x84/0xe0\n[ 2366.548260]  add_disk_fwnode+0x114/0x560\n[ 2366.548739]  null_add_dev+0x102d/0x1b80 [null_blk]\n[ 2366.549310]  ? __pfx_null_add_dev+0x10/0x10 [null_blk]\n[ 2366.549906]  ? mutex_lock+0xde/0x1c0\n[ 2366.550361]  ? __pfx_mutex_lock+0x10/0x10\n[ 2366.550827]  nullb_device_power_store+0x1e7/0x280 [null_blk]\n[ 2366.551499]  ? __pfx_nullb_device_power_store+0x10/0x10 [null_blk]\n[ 2366.552177]  ? __kmalloc_cache_noprof+0x1f5/0x470\n[ 2366.552748]  ? configfs_write_iter+0x35c/0x4e0\n[ 2366.553242]  configfs_write_iter+0x286/0x4e0\n[ 2366.553787]  vfs_write+0x52d/0xd00\n[ 2366.554169]  ? __pfx_vfs_write+0x10/0x10\n[ 2366.554679]  ? __pfx___css_rstat_updated+0x10/0x10\n[ 2366.555196]  ? fdget_pos+0x1cf/0x4c0\n[ 2366.555649]  ksys_write+0xfc/0x1d0\n......\n\nAdditionally, the err_dev path destroys all devices on nullb_list while\nconfigfs is still registered. If a racing mkdir() + poweron puts a user\ndevice on the list, null_destroy_dev()->null_free_dev() kfrees the user\ndevice's nullb_device but /sys/kernel/config/nullb/<name> is still\nreachable. Any userspace access to the item will trigger a UAF.\n\nFor simplicity, move configfs_register_subsystem() to the end to solve\nthe problems above."}],"providerMetadata":{"dateUpdated":"2026-09-17T16:07:10.992Z","orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","shortName":"Linux"},"references":[{"url":"https://git.kernel.org/stable/c/2679b11e9256bd70a5ef41783bab6ad6c34a3db1"},{"url":"https://git.kernel.org/stable/c/dbcedbe4819ae21274ea77469e61e46a878b9943"},{"url":"https://git.kernel.org/stable/c/57debc907aef66319d244009d3370dcd97388d37"},{"url":"https://git.kernel.org/stable/c/d761be1b8f2bbabc41252deb79a426d3f0d4fa10"},{"url":"https://git.kernel.org/stable/c/cab9bf5f68f76cd44e0ec92bd4a60c9b83656a36"},{"url":"https://git.kernel.org/stable/c/c9d293d6bb0575fcb1f3408129453187e2a28a4e"}],"title":"null_blk: register configfs subsystem after creating default devices","x_generator":{"engine":"bippy-1.2.0"}}},"cveMetadata":{"assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","assignerShortName":"Linux","cveId":"CVE-2026-90189","datePublished":"2026-09-17T16:07:10.992Z","dateReserved":"2026-09-11T19:38:34.792Z","dateUpdated":"2026-09-17T16:07:10.992Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.2"},"nvd":{"publishedDate":"2026-09-17 17:17:13","lastModifiedDate":"2026-09-17 17:17:13","problem_types":[],"metrics":[],"configurations":[]},"legacy_mitre":{"record":{"CveYear":"2026","CveId":"90189","Ordinal":"1","Title":"null_blk: register configfs subsystem after creating default dev","CVE":"CVE-2026-90189","Year":"2026"},"notes":[{"CveYear":"2026","CveId":"90189","Ordinal":"1","NoteData":"In the Linux kernel, the following vulnerability has been resolved:\n\nnull_blk: register configfs subsystem after creating default devices\n\nIn null_init(), configfs_register_subsystem() currently runs before\nregister_blkdev(), so when null_blk is built as a module, a racing mkdir()\n+ poweron from userspace can reach null_add_dev() while null_major is still\n0. __add_disk() then hits WARN_ON(disk->minors) (major=0 with minors!=0)\nand fails:\n\n[root@fedora ~]# [ 2366.521436] WARNING: block/genhd.c:476 at __add_disk+0x8a7/0xde0,\n[ 2366.523552] Modules linked in: null_blk(+) nft_fib_inet nft_fib_ipv4 nft_fib_ipv6 nft_fib\n[ 2366.529081] CPU: 26 UID: 0 PID: 1600 Comm: sh Not tainted 7.2.0-rc1+ #66 PREEMPT(full)\n......\n[ 2366.547251] Call Trace:\n[ 2366.547575]  <TASK>\n[ 2366.547831]  ? _raw_spin_lock+0x84/0xe0\n[ 2366.548260]  add_disk_fwnode+0x114/0x560\n[ 2366.548739]  null_add_dev+0x102d/0x1b80 [null_blk]\n[ 2366.549310]  ? __pfx_null_add_dev+0x10/0x10 [null_blk]\n[ 2366.549906]  ? mutex_lock+0xde/0x1c0\n[ 2366.550361]  ? __pfx_mutex_lock+0x10/0x10\n[ 2366.550827]  nullb_device_power_store+0x1e7/0x280 [null_blk]\n[ 2366.551499]  ? __pfx_nullb_device_power_store+0x10/0x10 [null_blk]\n[ 2366.552177]  ? __kmalloc_cache_noprof+0x1f5/0x470\n[ 2366.552748]  ? configfs_write_iter+0x35c/0x4e0\n[ 2366.553242]  configfs_write_iter+0x286/0x4e0\n[ 2366.553787]  vfs_write+0x52d/0xd00\n[ 2366.554169]  ? __pfx_vfs_write+0x10/0x10\n[ 2366.554679]  ? __pfx___css_rstat_updated+0x10/0x10\n[ 2366.555196]  ? fdget_pos+0x1cf/0x4c0\n[ 2366.555649]  ksys_write+0xfc/0x1d0\n......\n\nAdditionally, the err_dev path destroys all devices on nullb_list while\nconfigfs is still registered. If a racing mkdir() + poweron puts a user\ndevice on the list, null_destroy_dev()->null_free_dev() kfrees the user\ndevice's nullb_device but /sys/kernel/config/nullb/<name> is still\nreachable. Any userspace access to the item will trigger a UAF.\n\nFor simplicity, move configfs_register_subsystem() to the end to solve\nthe problems above.","Type":"Description","Title":"null_blk: register configfs subsystem after creating default dev"}]}}}