{"api_version":"1","generated_at":"2026-09-19T04:28:00+00:00","cve":"CVE-2026-90229","urls":{"html":"https://cve.report/CVE-2026-90229","api":"https://cve.report/api/cve/CVE-2026-90229.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2026-90229","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2026-90229"},"summary":{"title":"nvme-apple: Destroy the admin queue on removal","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nnvme-apple: Destroy the admin queue on removal\n\nThe admin queue is allocated with blk_mq_alloc_queue() but never\ndestroyed. nvme_free_ctrl() only drops the last reference and\nblk_mq_exit_queue() and blk_sync_queue() never run: the hctx is never\nmoved to q->unused_hctx_list and the timeout timer and work stay armed on\na queue that is about to be freed which will eventually oops inside\nblk_mq_timeout_work().\n\nThis can only be triggered when the controller fails to come up and is\nthen immediately torn down again which is why no one ever ran into this\nbefore.\n\nLet's just copy what the pcie driver does: unquiesce and destroy the admin\nqueue before nvme_uninit_ctrl().\n\nWith this the following WARN followed by a panic no longer happens:\n\n  WARNING: block/blk-mq.c:4390 at blk_mq_release+0x194/0x238, CPU#4: kworker/u34:4/119\n  CPU: 4 UID: 0 PID: 119 Comm: kworker/u34:4 Not tainted 7.2.0-rc1-dirty #248 PREEMPT\n  Hardware name: Apple Mac mini (M1, 2020) (DT)\n  Workqueue: nvme-wq apple_nvme_remove_dead_ctrl_work\n  pstate: 61400005 (nZCv daif +PAN -UAO -TCO +DIT -SSBS BTYPE=--)\n  pc : blk_mq_release+0x194/0x238\n  lr : blk_mq_release+0x58/0x238\n  sp : ffffc000833a3b50\n  x29: ffffc000833a3b50 x28: ffff80001d0450f8 x27: ffff800020c95200\n  x26: 0000000000000088 x25: 0000000000000000 x24: ffff800020f36805\n  x23: 0000000000000000 x22: ffffc00081a86878 x21: ffff800020be9c60\n  x20: 0000000000000000 x19: ffff800022501698 x18: 000000000000000a\n  x17: 7365757165722066 x16: 666f7265776f7020 x15: 0000000000000000\n  x14: 0000000000000028 x13: 0000000000004def x12: 0000000000000003\n  x11: 0000000000000000 x10: 0000000000000000 x9 : ffffc000805b4fc8\n  x8 : ffffc00081915820 x7 : ffffc00081c4f3c8 x6 : 0000000000000001\n  x5 : 0000000000000004 x4 : ffff800022498d80 x3 : ffffc000833a3b14\n  x2 : 0000000000000000 x1 : 0000000000000000 x0 : ffff800022501698\n  Call trace:\n   blk_mq_release+0x194/0x238 (P)\n   blk_put_queue+0x8c/0xf0\n   nvme_free_ctrl+0x4c/0x260\n   device_release+0x44/0x128\n   kobject_put+0xa0/0x120\n   put_device+0x1c/0x40\n   nvme_uninit_ctrl+0x48/0x60\n   apple_nvme_remove+0x54/0xb0\n   platform_remove+0x28/0x40\n   device_remove+0x54/0x98\n   device_release_driver_internal+\n   device_release_driver+0x20/0x38\n   apple_nvme_remove_dead_ctrl_wor\n   process_one_work+0x1f4/0x770\n   worker_thread+0x1b8/0x360\n   kthread+0x140/0x160\n   ret_from_fork+0x10/0x20\n  irq event stamp: 448\n  hardirqs last  enabled at (447):in_unlock_irqrestore+0x74/0x80\n  hardirqs last disabled at (448): [<ffffc000811cf5c0>] el1_brk64+0x20/0x60\n  softirqs last  enabled at (0): [ess+0xb28/0x2698\n  softirqs last disabled at (0): [<0000000000000000>] 0x0\n  ---[ end trace 0000000000000000\n  Unable to handle kernel NULL pointer dereference at virtual address 0000000000000000\n  Mem abort info:\n    ESR = 0x0000000096000005\n    EC = 0x25: DABT (current EL),\n    SET = 0, FnV = 0\n    EA = 0, S1PTW = 0\n    FSC = 0x05: level 1 translation fault\n  Data abort info:\n    ISV = 0, ISS = 0x00000005, ISS2 = 0x00000000\n    CM = 0, WnR = 0, TnD = 0, TagA\n    GCS = 0, Overlay = 0, DirtyBit = 0, Xs = 0\n  [0000000000000000] user address\n  Internal error: Oops: 0000000096000005 [#1]  SMP\n  CPU: 7 UID: 0 PID: 54 Comm: kwor          7.2.0-rc1-dirty #248PREEMPT\n  Tainted: [W]=WARN\n  Hardware name: Apple Mac mini (M1, 2020) (DT)\n  Workqueue: kblockd blk_mq_timeou\n  pstate: 01400005 (nzcv daif +PAN -UAO -TCO +DIT -SSBS BTYPE=--)\n  pc : percpu_ref_tryget_many.cons\n  lr : percpu_ref_tryget_many.constprop.0+0xc0/0x168\n  sp : ffffc000829cbce0\n  x29: ffffc000829cbce0 x28: ffff800020be9f48 x27: ffff800013e503c0\n  x26: 0000000000000108 x25: 000009c05\n  x23: 0000000000000000 x22: ffffc000819f5000 x21: ffff800020be9f48\n  x20: ffff8001deda4808 x19: ffff8000a\n  x17: 00000000580e1fac x16: ffffc00082bbbb7c x15: 0000000000000000\n  x14: 0000000000000028 x13: 000000001\n  x11: 0000000000000000 x10: 0000000000000000 x9 : ffffc000829cbc20\n  x8 : \n---truncated---","state":"PUBLISHED","assigner":"Linux","published_at":"2026-09-17 17:17:18","updated_at":"2026-09-18 18:17:47"},"problem_types":[],"metrics":[{"version":"3.1","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","score":"7.4","severity":"HIGH","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","data":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":7.4,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"}},{"version":"3.1","source":"CNA","type":"DECLARED","score":"7.4","severity":"HIGH","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","data":{"baseScore":7.4,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"}}],"references":[{"url":"https://git.kernel.org/stable/c/87d5b9864c8118d26f54de4b66d2bddf2c659272","name":"https://git.kernel.org/stable/c/87d5b9864c8118d26f54de4b66d2bddf2c659272","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/5f6f4777b7a8676251139dbfbcdec3cb578f0e40","name":"https://git.kernel.org/stable/c/5f6f4777b7a8676251139dbfbcdec3cb578f0e40","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/215d1682f0bae495f3f9cf692b358116b7a18602","name":"https://git.kernel.org/stable/c/215d1682f0bae495f3f9cf692b358116b7a18602","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/c11685ee4eedc70f738b117a4a8c0fbe84cd79b3","name":"https://git.kernel.org/stable/c/c11685ee4eedc70f738b117a4a8c0fbe84cd79b3","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/bf51e306e3dcffd1a63ef09a7a39d28f3578dd2d","name":"https://git.kernel.org/stable/c/bf51e306e3dcffd1a63ef09a7a39d28f3578dd2d","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-90229","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-90229","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 5bd2927aceba181b84286e00aa2f56e117e699c3 5f6f4777b7a8676251139dbfbcdec3cb578f0e40 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 5bd2927aceba181b84286e00aa2f56e117e699c3 bf51e306e3dcffd1a63ef09a7a39d28f3578dd2d git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 5bd2927aceba181b84286e00aa2f56e117e699c3 215d1682f0bae495f3f9cf692b358116b7a18602 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 5bd2927aceba181b84286e00aa2f56e117e699c3 c11685ee4eedc70f738b117a4a8c0fbe84cd79b3 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 5bd2927aceba181b84286e00aa2f56e117e699c3 87d5b9864c8118d26f54de4b66d2bddf2c659272 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 5.19","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 5.19 semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 6.6.157 6.6.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 6.12.110 6.12.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 6.18.52 6.18.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 7.2.6 7.2.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 7.3-rc1 * original_commit_for_fix","platforms":[]}],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[],"vendor_comments":[],"enrichments":{"kev":null,"epss":{"cve_year":"2026","cve_id":"90229","cve":"CVE-2026-90229","epss":"0.002000000","percentile":"0.102110000","score_date":"2026-09-18","updated_at":"2026-09-19 00:06:16"},"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"cna":{"affected":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/nvme/host/apple.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"5f6f4777b7a8676251139dbfbcdec3cb578f0e40","status":"affected","version":"5bd2927aceba181b84286e00aa2f56e117e699c3","versionType":"git"},{"lessThan":"bf51e306e3dcffd1a63ef09a7a39d28f3578dd2d","status":"affected","version":"5bd2927aceba181b84286e00aa2f56e117e699c3","versionType":"git"},{"lessThan":"215d1682f0bae495f3f9cf692b358116b7a18602","status":"affected","version":"5bd2927aceba181b84286e00aa2f56e117e699c3","versionType":"git"},{"lessThan":"c11685ee4eedc70f738b117a4a8c0fbe84cd79b3","status":"affected","version":"5bd2927aceba181b84286e00aa2f56e117e699c3","versionType":"git"},{"lessThan":"87d5b9864c8118d26f54de4b66d2bddf2c659272","status":"affected","version":"5bd2927aceba181b84286e00aa2f56e117e699c3","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/nvme/host/apple.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"5.19"},{"lessThan":"5.19","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.157","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.110","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.52","versionType":"semver"},{"lessThanOrEqual":"7.2.*","status":"unaffected","version":"7.2.6","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.3-rc1","versionType":"original_commit_for_fix"}]}],"cpeApplicability":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"6.6.157","versionStartIncluding":"5.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"6.12.110","versionStartIncluding":"5.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"6.18.52","versionStartIncluding":"5.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"7.2.6","versionStartIncluding":"5.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"7.3-rc1","versionStartIncluding":"5.19","vulnerable":true}],"negate":false,"operator":"OR"}]}],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nnvme-apple: Destroy the admin queue on removal\n\nThe admin queue is allocated with blk_mq_alloc_queue() but never\ndestroyed. nvme_free_ctrl() only drops the last reference and\nblk_mq_exit_queue() and blk_sync_queue() never run: the hctx is never\nmoved to q->unused_hctx_list and the timeout timer and work stay armed on\na queue that is about to be freed which will eventually oops inside\nblk_mq_timeout_work().\n\nThis can only be triggered when the controller fails to come up and is\nthen immediately torn down again which is why no one ever ran into this\nbefore.\n\nLet's just copy what the pcie driver does: unquiesce and destroy the admin\nqueue before nvme_uninit_ctrl().\n\nWith this the following WARN followed by a panic no longer happens:\n\n  WARNING: block/blk-mq.c:4390 at blk_mq_release+0x194/0x238, CPU#4: kworker/u34:4/119\n  CPU: 4 UID: 0 PID: 119 Comm: kworker/u34:4 Not tainted 7.2.0-rc1-dirty #248 PREEMPT\n  Hardware name: Apple Mac mini (M1, 2020) (DT)\n  Workqueue: nvme-wq apple_nvme_remove_dead_ctrl_work\n  pstate: 61400005 (nZCv daif +PAN -UAO -TCO +DIT -SSBS BTYPE=--)\n  pc : blk_mq_release+0x194/0x238\n  lr : blk_mq_release+0x58/0x238\n  sp : ffffc000833a3b50\n  x29: ffffc000833a3b50 x28: ffff80001d0450f8 x27: ffff800020c95200\n  x26: 0000000000000088 x25: 0000000000000000 x24: ffff800020f36805\n  x23: 0000000000000000 x22: ffffc00081a86878 x21: ffff800020be9c60\n  x20: 0000000000000000 x19: ffff800022501698 x18: 000000000000000a\n  x17: 7365757165722066 x16: 666f7265776f7020 x15: 0000000000000000\n  x14: 0000000000000028 x13: 0000000000004def x12: 0000000000000003\n  x11: 0000000000000000 x10: 0000000000000000 x9 : ffffc000805b4fc8\n  x8 : ffffc00081915820 x7 : ffffc00081c4f3c8 x6 : 0000000000000001\n  x5 : 0000000000000004 x4 : ffff800022498d80 x3 : ffffc000833a3b14\n  x2 : 0000000000000000 x1 : 0000000000000000 x0 : ffff800022501698\n  Call trace:\n   blk_mq_release+0x194/0x238 (P)\n   blk_put_queue+0x8c/0xf0\n   nvme_free_ctrl+0x4c/0x260\n   device_release+0x44/0x128\n   kobject_put+0xa0/0x120\n   put_device+0x1c/0x40\n   nvme_uninit_ctrl+0x48/0x60\n   apple_nvme_remove+0x54/0xb0\n   platform_remove+0x28/0x40\n   device_remove+0x54/0x98\n   device_release_driver_internal+\n   device_release_driver+0x20/0x38\n   apple_nvme_remove_dead_ctrl_wor\n   process_one_work+0x1f4/0x770\n   worker_thread+0x1b8/0x360\n   kthread+0x140/0x160\n   ret_from_fork+0x10/0x20\n  irq event stamp: 448\n  hardirqs last  enabled at (447):in_unlock_irqrestore+0x74/0x80\n  hardirqs last disabled at (448): [<ffffc000811cf5c0>] el1_brk64+0x20/0x60\n  softirqs last  enabled at (0): [ess+0xb28/0x2698\n  softirqs last disabled at (0): [<0000000000000000>] 0x0\n  ---[ end trace 0000000000000000\n  Unable to handle kernel NULL pointer dereference at virtual address 0000000000000000\n  Mem abort info:\n    ESR = 0x0000000096000005\n    EC = 0x25: DABT (current EL),\n    SET = 0, FnV = 0\n    EA = 0, S1PTW = 0\n    FSC = 0x05: level 1 translation fault\n  Data abort info:\n    ISV = 0, ISS = 0x00000005, ISS2 = 0x00000000\n    CM = 0, WnR = 0, TnD = 0, TagA\n    GCS = 0, Overlay = 0, DirtyBit = 0, Xs = 0\n  [0000000000000000] user address\n  Internal error: Oops: 0000000096000005 [#1]  SMP\n  CPU: 7 UID: 0 PID: 54 Comm: kwor          7.2.0-rc1-dirty #248PREEMPT\n  Tainted: [W]=WARN\n  Hardware name: Apple Mac mini (M1, 2020) (DT)\n  Workqueue: kblockd blk_mq_timeou\n  pstate: 01400005 (nzcv daif +PAN -UAO -TCO +DIT -SSBS BTYPE=--)\n  pc : percpu_ref_tryget_many.cons\n  lr : percpu_ref_tryget_many.constprop.0+0xc0/0x168\n  sp : ffffc000829cbce0\n  x29: ffffc000829cbce0 x28: ffff800020be9f48 x27: ffff800013e503c0\n  x26: 0000000000000108 x25: 000009c05\n  x23: 0000000000000000 x22: ffffc000819f5000 x21: ffff800020be9f48\n  x20: ffff8001deda4808 x19: ffff8000a\n  x17: 00000000580e1fac x16: ffffc00082bbbb7c x15: 0000000000000000\n  x14: 0000000000000028 x13: 000000001\n  x11: 0000000000000000 x10: 0000000000000000 x9 : ffffc000829cbc20\n  x8 : \n---truncated---"}],"metrics":[{"cvssV3_1":{"baseScore":7.4,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"scenarios":[{"lang":"en","value":"AV:L - The bug is local ANS host teardown: apple_nvme_probe() allocates ctrl->admin_q, then apple_nvme_reset_work() queues apple_nvme_remove_dead_ctrl_work() which calls device_release_driver() into apple_nvme_remove(). This is the DT-bound SoC NVMe driver (apple,t8103-nvme-ans2), not a remote NVMe-oF/TCP message path.\nAC:H - apple_nvme_reset_work() only queues remove_work from its out: path when ANS/RTKit bring-up or nvme_init_ctrl_finish() fails after admin_q is live. The fix notes this fires only when the controller fails to come up; a working ANS does not take that path, and the attacker cannot force apple_rtkit_boot() or Identify to fail.\nPR:N - apple_nvme_probe() calls nvme_reset_ctrl() from driver-core context with no capable() check. On failure, apple_nvme_remove_dead_ctrl_work() runs on nvme-wq and invokes device_release_driver() without a process credential; opening /dev/nvme* or writing sysfs unbind is not required.\nUI:N - nvme_reset_ctrl() is scheduled from apple_nvme_probe(), and the oops runs on nvme-wq/kblockd. No victim mount, open, or other interactive action is required once ANS initialization fails.\nS:U - blk_mq_timeout_work() use-after-free of the host admin request_queue occurs in the same kernel that runs nvme-apple; it is not a VM escape, guest-to-host, or IOMMU/DMA boundary bypass.\nC:H - apple_nvme_remove() calls nvme_uninit_ctrl() then nvme_free_ctrl() then blk_put_queue() without blk_mq_destroy_queue(), so blk_mq_release() kfree's q->queue_hw_ctx while q->timeout remains armed and blk_free_queue_rcu() later frees the request_queue, a UAF read primitive.\nI:H - The same skipped blk_sync_queue()/blk_mq_exit_queue() lets blk_mq_timeout_work() walk a kfree'd queue_hw_ctx and a request_queue freed via RCU, so reclaimed hctx/queue memory can divert the kblockd worker into attacker-controlled writes and control-flow hijack.\nA:H - The reported reproducer WARNs in blk_mq_release() then oopses with a NULL dereference in percpu_ref_tryget_many() from blk_mq_timeout_work() on kblockd, panicking the Apple Silicon host."}]}],"providerMetadata":{"dateUpdated":"2026-09-18T17:53:56.396Z","orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","shortName":"Linux"},"references":[{"url":"https://git.kernel.org/stable/c/5f6f4777b7a8676251139dbfbcdec3cb578f0e40"},{"url":"https://git.kernel.org/stable/c/bf51e306e3dcffd1a63ef09a7a39d28f3578dd2d"},{"url":"https://git.kernel.org/stable/c/215d1682f0bae495f3f9cf692b358116b7a18602"},{"url":"https://git.kernel.org/stable/c/c11685ee4eedc70f738b117a4a8c0fbe84cd79b3"},{"url":"https://git.kernel.org/stable/c/87d5b9864c8118d26f54de4b66d2bddf2c659272"}],"title":"nvme-apple: Destroy the admin queue on removal","x_generator":{"engine":"bippy-1.2.0"}}},"cveMetadata":{"assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","assignerShortName":"Linux","cveId":"CVE-2026-90229","datePublished":"2026-09-17T16:07:37.285Z","dateReserved":"2026-09-11T19:38:34.794Z","dateUpdated":"2026-09-18T17:53:56.396Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.2"},"nvd":{"publishedDate":"2026-09-17 17:17:18","lastModifiedDate":"2026-09-18 18:17:47","problem_types":[],"metrics":{"cvssMetricV31":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":7.4,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.4,"impactScore":5.9}]},"configurations":[]},"legacy_mitre":{"record":{"CveYear":"2026","CveId":"90229","Ordinal":"1","Title":"nvme-apple: Destroy the admin queue on removal","CVE":"CVE-2026-90229","Year":"2026"},"notes":[{"CveYear":"2026","CveId":"90229","Ordinal":"1","NoteData":"In the Linux kernel, the following vulnerability has been resolved:\n\nnvme-apple: Destroy the admin queue on removal\n\nThe admin queue is allocated with blk_mq_alloc_queue() but never\ndestroyed. nvme_free_ctrl() only drops the last reference and\nblk_mq_exit_queue() and blk_sync_queue() never run: the hctx is never\nmoved to q->unused_hctx_list and the timeout timer and work stay armed on\na queue that is about to be freed which will eventually oops inside\nblk_mq_timeout_work().\n\nThis can only be triggered when the controller fails to come up and is\nthen immediately torn down again which is why no one ever ran into this\nbefore.\n\nLet's just copy what the pcie driver does: unquiesce and destroy the admin\nqueue before nvme_uninit_ctrl().\n\nWith this the following WARN followed by a panic no longer happens:\n\n  WARNING: block/blk-mq.c:4390 at blk_mq_release+0x194/0x238, CPU#4: kworker/u34:4/119\n  CPU: 4 UID: 0 PID: 119 Comm: kworker/u34:4 Not tainted 7.2.0-rc1-dirty #248 PREEMPT\n  Hardware name: Apple Mac mini (M1, 2020) (DT)\n  Workqueue: nvme-wq apple_nvme_remove_dead_ctrl_work\n  pstate: 61400005 (nZCv daif +PAN -UAO -TCO +DIT -SSBS BTYPE=--)\n  pc : blk_mq_release+0x194/0x238\n  lr : blk_mq_release+0x58/0x238\n  sp : ffffc000833a3b50\n  x29: ffffc000833a3b50 x28: ffff80001d0450f8 x27: ffff800020c95200\n  x26: 0000000000000088 x25: 0000000000000000 x24: ffff800020f36805\n  x23: 0000000000000000 x22: ffffc00081a86878 x21: ffff800020be9c60\n  x20: 0000000000000000 x19: ffff800022501698 x18: 000000000000000a\n  x17: 7365757165722066 x16: 666f7265776f7020 x15: 0000000000000000\n  x14: 0000000000000028 x13: 0000000000004def x12: 0000000000000003\n  x11: 0000000000000000 x10: 0000000000000000 x9 : ffffc000805b4fc8\n  x8 : ffffc00081915820 x7 : ffffc00081c4f3c8 x6 : 0000000000000001\n  x5 : 0000000000000004 x4 : ffff800022498d80 x3 : ffffc000833a3b14\n  x2 : 0000000000000000 x1 : 0000000000000000 x0 : ffff800022501698\n  Call trace:\n   blk_mq_release+0x194/0x238 (P)\n   blk_put_queue+0x8c/0xf0\n   nvme_free_ctrl+0x4c/0x260\n   device_release+0x44/0x128\n   kobject_put+0xa0/0x120\n   put_device+0x1c/0x40\n   nvme_uninit_ctrl+0x48/0x60\n   apple_nvme_remove+0x54/0xb0\n   platform_remove+0x28/0x40\n   device_remove+0x54/0x98\n   device_release_driver_internal+\n   device_release_driver+0x20/0x38\n   apple_nvme_remove_dead_ctrl_wor\n   process_one_work+0x1f4/0x770\n   worker_thread+0x1b8/0x360\n   kthread+0x140/0x160\n   ret_from_fork+0x10/0x20\n  irq event stamp: 448\n  hardirqs last  enabled at (447):in_unlock_irqrestore+0x74/0x80\n  hardirqs last disabled at (448): [<ffffc000811cf5c0>] el1_brk64+0x20/0x60\n  softirqs last  enabled at (0): [ess+0xb28/0x2698\n  softirqs last disabled at (0): [<0000000000000000>] 0x0\n  ---[ end trace 0000000000000000\n  Unable to handle kernel NULL pointer dereference at virtual address 0000000000000000\n  Mem abort info:\n    ESR = 0x0000000096000005\n    EC = 0x25: DABT (current EL),\n    SET = 0, FnV = 0\n    EA = 0, S1PTW = 0\n    FSC = 0x05: level 1 translation fault\n  Data abort info:\n    ISV = 0, ISS = 0x00000005, ISS2 = 0x00000000\n    CM = 0, WnR = 0, TnD = 0, TagA\n    GCS = 0, Overlay = 0, DirtyBit = 0, Xs = 0\n  [0000000000000000] user address\n  Internal error: Oops: 0000000096000005 [#1]  SMP\n  CPU: 7 UID: 0 PID: 54 Comm: kwor          7.2.0-rc1-dirty #248PREEMPT\n  Tainted: [W]=WARN\n  Hardware name: Apple Mac mini (M1, 2020) (DT)\n  Workqueue: kblockd blk_mq_timeou\n  pstate: 01400005 (nzcv daif +PAN -UAO -TCO +DIT -SSBS BTYPE=--)\n  pc : percpu_ref_tryget_many.cons\n  lr : percpu_ref_tryget_many.constprop.0+0xc0/0x168\n  sp : ffffc000829cbce0\n  x29: ffffc000829cbce0 x28: ffff800020be9f48 x27: ffff800013e503c0\n  x26: 0000000000000108 x25: 000009c05\n  x23: 0000000000000000 x22: ffffc000819f5000 x21: ffff800020be9f48\n  x20: ffff8001deda4808 x19: ffff8000a\n  x17: 00000000580e1fac x16: ffffc00082bbbb7c x15: 0000000000000000\n  x14: 0000000000000028 x13: 000000001\n  x11: 0000000000000000 x10: 0000000000000000 x9 : ffffc000829cbc20\n  x8 : \n---truncated---","Type":"Description","Title":"nvme-apple: Destroy the admin queue on removal"}]}}}