---
id: CVE-2026-90185
title: |-
  In the Linux kernel, the following vulnerability has been resolved:

  null_blk: serialize configfs attribute stores with the lock

  The NULLB_DEVICE_ATTR _store takes no lock: apply_fn attributes
  (submit_queues, poll_queues) get dev->NAME …
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  null_blk: serialize configfs attribute stores with the lock

  The NULLB_DEVICE_ATTR _store takes no lock: apply_fn attributes
  (submit_queues, poll_queues) get dev->NAME …
severity: none
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 45919fbfe1c487c17ea1d198534339a5e8abeae3 <
    8e839ed5210399a0330a8a6c5885c1d40a537c6d
  - >-
    Linux >= 45919fbfe1c487c17ea1d198534339a5e8abeae3 <
    88d806d0e1d36246208386a8e55b511c1b3d647c
  - >-
    Linux >= 45919fbfe1c487c17ea1d198534339a5e8abeae3 <
    3945ce8cbce4e328e6fdf0b522dc71e340de19db
  - >-
    Linux >= 45919fbfe1c487c17ea1d198534339a5e8abeae3 <
    65cae82fd3c39b53430672cb9e3ecd267471a6ce
  - >-
    Linux >= 45919fbfe1c487c17ea1d198534339a5e8abeae3 <
    c70994c2862b05e44728912b2ea9487d31e2aea7
  - >-
    Linux >= 45919fbfe1c487c17ea1d198534339a5e8abeae3 <
    7e7fff51808237703a3a1df6dd5cae1dfd1db86d
  - Linux 5.5
published: '2026-09-17'
updated: '2026-09-17'
sourceUpdated: '2026-09-17T17:17:12.980'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-90185'
references:
  - url: 'https://git.kernel.org/stable/c/3945ce8cbce4e328e6fdf0b522dc71e340de19db'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/65cae82fd3c39b53430672cb9e3ecd267471a6ce'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/7e7fff51808237703a3a1df6dd5cae1dfd1db86d'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/88d806d0e1d36246208386a8e55b511c1b3d647c'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/8e839ed5210399a0330a8a6c5885c1d40a537c6d'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/c70994c2862b05e44728912b2ea9487d31e2aea7'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
tags:
  - nvd
  - cve.org
ingestedAt: '2026-09-17T16:21:47.865Z'
epss: 0.00205
epssPercentile: 0.10895
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

null_blk: serialize configfs attribute stores with the lock

The NULLB_DEVICE_ATTR _store takes no lock: apply_fn attributes
(submit_queues, poll_queues) get dev->NAME written again after apply_fn
returns, outside its lock; APPLY=NULL attributes are entirely lockless.
configfs only serializes stores per-open-file, so concurrent stores on
separate fds race.

For apply_fn attributes, once one store's apply_fn has reconfigured the
hardware, a second (losing) store can still overwrite dev->NAME
afterwards. This leaves dev->submit_queues out of sync with the live
queue count, which is later caught by the WARN_ON_ONCE() in
null_map_queues().

For !apply_fn attributes, power_store()'s null_add_dev() validates and
builds the device under "lock" but only sets CONFIGURED afterwards. A store
slipping in during this window can change a field mid-setup -- for example,
zone_nr_conv can be pushed above nr_zones after it has already been
clamped, leading to an out-of-bounds dev->zones[] access.

Take "lock" in the macro around the apply_fn call, the CONFIGURED test and
the field write, and move it out of nullb_apply_submit_queues()/
nullb_apply_poll_queues() so both paths are covered once. This serializes
stores with power_store's setup and with each other.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.