CVE-2026-90184

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description A race condition exists in the null blk driver where attribute store methods generated with NULLB DEVICE ATTR() do not use locks when updating device configurations. Because the NULLB DEV FL CONFIGURED flag is only set after the null add dev() function returns, concurrent writes to attributes can modify the device configuration while it is being initialized. This can lead to several issues: if the dev->zoned variable is modified during setup, it may cause the blk revalidate disk zones() function to be called for a queue without the BLK FEAT ZONED feature, resulting in a system warning and setup failure. More critically, if dev->zoned is cleared during this window, a zoned disk may be created without initialized zone resources, leading to a null pointer dereference in the null process zoned cmd() function during the first write operation.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.