{"id":25598,"date":"2026-09-18T04:31:36","date_gmt":"2026-09-17T20:31:36","guid":{"rendered":"https:\/\/www.54iter.cn\/?vuln=cve-2026-90189"},"modified":"2026-09-18T04:31:36","modified_gmt":"2026-09-17T20:31:36","slug":"cve-2026-90189","status":"publish","type":"vuln","link":"https:\/\/www.54iter.cn\/?vuln=cve-2026-90189","title":{"rendered":"CVE-2026-90189 &#8211; In the Linux kernel, the following vulnerability has been resolved:\n\nnull_blk: register co"},"content":{"rendered":"<p>In the Linux kernel, the following vulnerability has been resolved:<\/p>\n<p>null_blk: register configfs subsystem after creating default devices<\/p>\n<p>In null_init(), configfs_register_subsystem() currently runs before<br \/>\nregister_blkdev(), so when null_blk is built as a module, a racing mkdir()<br \/>\n+ poweron from userspace can reach null_add_dev() while null_major is still<br \/>\n0. __add_disk() then hits WARN_ON(disk-&gt;minors) (major=0 with minors!=0)<br \/>\nand fails:<\/p>\n<p>[root@fedora ~]# [ 2366.521436] WARNING: block\/genhd.c:476 at __add_disk+0x8a7\/0xde0,<br \/>\n[ 2366.523552] Modules linked in: null_blk(+) nft_fib_inet nft_fib_ipv4 nft_fib_ipv6 nft_fib<br \/>\n[ 2366.529081] CPU: 26 UID: 0 PID: 1600 Comm: sh Not tainted 7.2.0-rc1+ #66 PREEMPT(full)<br \/>\n&#8230;&#8230;<br \/>\n[ 2366.547251] Call Trace:<br \/>\n[ 2366.547575]<br \/>\n[ 2366.547831]  ? _raw_spin_lock+0x84\/0xe0<br \/>\n[ 2366.548260]  add_disk_fwnode+0x114\/0x560<br \/>\n[ 2366.548739]  null_add_dev+0x102d\/0x1b80 [null_blk]<br \/>\n[ 2366.549310]  ? __pfx_null_add_dev+0x10\/0x10 [null_blk]<br \/>\n[ 2366.549906]  ? mutex_lock+0xde\/0x1c0<br \/>\n[ 2366.550361]  ? __pfx_mutex_lock+0x10\/0x10<br \/>\n[ 2366.550827]  nullb_device_power_store+0x1e7\/0x280 [null_blk]<br \/>\n[ 2366.551499]  ? __pfx_nullb_device_power_store+0x10\/0x10 [null_blk]<br \/>\n[ 2366.552177]  ? __kmalloc_cache_noprof+0x1f5\/0x470<br \/>\n[ 2366.552748]  ? configfs_write_iter+0x35c\/0x4e0<br \/>\n[ 2366.553242]  configfs_write_iter+0x286\/0x4e0<br \/>\n[ 2366.553787]  vfs_write+0x52d\/0xd00<br \/>\n[ 2366.554169]  ? __pfx_vfs_write+0x10\/0x10<br \/>\n[ 2366.554679]  ? __pfx___css_rstat_updated+0x10\/0x10<br \/>\n[ 2366.555196]  ? fdget_pos+0x1cf\/0x4c0<br \/>\n[ 2366.555649]  ksys_write+0xfc\/0x1d0<br \/>\n&#8230;&#8230;<\/p>\n<p>Additionally, the err_dev path destroys all devices on nullb_list while<br \/>\nconfigfs is still registered. If a racing mkdir() + poweron puts a user<br \/>\ndevice on the list, null_destroy_dev()-&gt;null_free_dev() kfrees the user<br \/>\ndevice&#8217;s nullb_device but \/sys\/kernel\/config\/nullb\/ is still<br \/>\nreachable. Any userspace access to the item will trigger a UAF.<\/p>\n<p>For simplicity, move configfs_register_subsystem() to the end to solve<br \/>\nthe problems above.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>In the Linux kernel, the following vulnerability has been resolved:<\/p>\n<p>null_blk: register configfs subsystem after creating default devices<\/p>\n<p>In null_init(), configfs_register_subsystem() currently runs <\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-25598","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/25598","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=25598"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=25598"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=25598"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}