---
id: CVE-2026-90188
title: |-
  In the Linux kernel, the following vulnerability has been resolved:

  null_blk: free global tag_set on init error path

  If shared_tags is enabled, null_setup_tagset() allocates the global tag_set
  via null_init_global_tag_set()
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  null_blk: free global tag_set on init error path

  If shared_tags is enabled, null_setup_tagset() allocates the global tag_set
  via null_init_global_tag_set(). If device …
severity: none
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 82f402fefa50f1675bf918bcd009981bd6b30ac8 <
    0b2faa330184340d9418ad2c627c2ae881772e33
  - >-
    Linux >= 82f402fefa50f1675bf918bcd009981bd6b30ac8 <
    665c94554ff0d5d88caae7f40c16c8e0a3369eda
  - >-
    Linux >= 82f402fefa50f1675bf918bcd009981bd6b30ac8 <
    2882e1450fa4597811a951196e07553ea134eb31
  - >-
    Linux >= 82f402fefa50f1675bf918bcd009981bd6b30ac8 <
    2b59484ac1e64dd78dbe8c6140891c6308085a75
  - >-
    Linux >= 82f402fefa50f1675bf918bcd009981bd6b30ac8 <
    081cf37e8a0e00cd91d6df53172c9d928790a798
  - >-
    Linux >= 82f402fefa50f1675bf918bcd009981bd6b30ac8 <
    5a1c5ff3a49ba93a1fd0b70537e7a0164071760d
  - Linux 4.13
published: '2026-09-17'
updated: '2026-09-17'
sourceUpdated: '2026-09-17T17:17:13.397'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-90188'
references:
  - url: 'https://git.kernel.org/stable/c/081cf37e8a0e00cd91d6df53172c9d928790a798'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/0b2faa330184340d9418ad2c627c2ae881772e33'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/2882e1450fa4597811a951196e07553ea134eb31'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/2b59484ac1e64dd78dbe8c6140891c6308085a75'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/5a1c5ff3a49ba93a1fd0b70537e7a0164071760d'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/665c94554ff0d5d88caae7f40c16c8e0a3369eda'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
tags:
  - nvd
  - cve.org
ingestedAt: '2026-09-17T16:21:47.864Z'
epss: 0.00205
epssPercentile: 0.09327
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

null_blk: free global tag_set on init error path

If shared_tags is enabled, null_setup_tagset() allocates the global tag_set
via null_init_global_tag_set(). If device creation later fails, err_dev
destroys the default devices and calls unregister_blkdev(), but never frees
the global tag_set. Since module init failed, null_exit() is never invoked,
so the global tag_set's tags and maps are permanently leaked.

Free the global tag_set in err_dev, matching null_exit() which does
if (tag_set.ops) blk_mq_free_tag_set(&tag_set).

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.