CVE-2026-90189

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description An issue exists in the null blk driver where configfs register subsystem() is called before register blkdev() in the null init() function. When null blk is used as a module, a race condition occurs if userspace performs a mkdir() and poweron operation, allowing null add dev() to be reached while null major is still 0. This causes add disk() to fail. Furthermore, in the err dev path, devices on the nullb list are destroyed while configfs remains registered. If a user device is added during this race, null destroy dev() calls null free dev() to free the nullb device, but the path /sys/kernel/config/nullb/<name> remains accessible, leading to a Use-After-Free (UAF) condition—a scenario where the system attempts to use memory after it has been freed—upon userspace access.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.