{
    "dataType": "CVE_RECORD",
    "dataVersion": "5.2",
    "cveMetadata": {
        "cveId": "CVE-2026-90181",
        "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "state": "PUBLISHED",
        "assignerShortName": "Linux",
        "dateReserved": "2026-09-11T19:38:34.791Z",
        "datePublished": "2026-09-17T16:07:05.725Z",
        "dateUpdated": "2026-10-19T08:59:18.253Z"
    },
    "containers": {
        "cna": {
            "providerMetadata": {
                "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
                "shortName": "Linux",
                "dateUpdated": "2026-10-19T08:59:18.253Z"
            },
            "descriptions": [
                {
                    "lang": "en",
                    "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nublk: avoid teardown retry loop on xarray allocation failure\n\n__ublk_shmem_remove_ranges() removes matching maple tree ranges in\nbatches, but first stores each range into a temporary xarray so that the\npages can be unpinned after dropping the maple tree lock.\n\nThat temporary xarray is filled under the maple tree lock with\nxa_store(..., GFP_ATOMIC). If the store fails before mas_erase(), the\ncurrent range is left in the tree and the helper returns false. The\nouter ublk_shmem_remove_ranges() loop then immediately retries the same\nrange. While the atomic allocation keeps failing, the teardown path has\nno forward progress.\n\nThe issue can be reproduced with radix_tree_node failslab injection after\na SHMEM_ZC buffer has already been registered:\n\n  # Kernel config:\n  #   CONFIG_BLK_DEV_UBLK=y\n  #   CONFIG_DEBUG_FS=y\n  #   CONFIG_FAULT_INJECTION=y\n  #   CONFIG_FAULT_INJECTION_DEBUG_FS=y\n  #   CONFIG_FAILSLAB=y\n\n  echo 10 > /proc/sys/vm/nr_hugepages\n  mkdir -p /tmp/htlb\n  mount -t hugetlbfs none /tmp/htlb\n  fallocate -l 4M /tmp/htlb/ublk_buf\n\n  dev_id=$(kublk add -t null --shmem_zc \\\n\t\t--htlb /tmp/htlb/ublk_buf |\n\t   awk -F '[ :]' '/dev id/ {print $3}')\n\n  echo 1 > /sys/kernel/slab/radix_tree_node/failslab\n  echo Y > /sys/kernel/debug/failslab/cache-filter\n  echo Y > /sys/kernel/debug/failslab/ignore-gfp-wait\n  echo 1 > /sys/kernel/debug/failslab/interval\n  echo -1 > /sys/kernel/debug/failslab/times\n  echo 100 > /sys/kernel/debug/failslab/probability\n\n  kublk del -n \"$dev_id\"\n\nOn the unfixed kernel the delete command was still running after 3\nseconds. Disabling failslab made it return. The fault-injection stack\nshowed:\n\n  should_failslab\n  kmem_cache_alloc_lru_noprof\n  __xas_nomem\n  __xa_store\n  xa_store\n  __ublk_shmem_remove_ranges\n  ublk_cdev_rel\n  ublk_ctrl_del_dev\n\nRemove the allocation from the teardown loop. Keep the existing batch\nlimit, but collect {base_pfn, nr_pages} pairs in a fixed-size stack array.\nOnce a matching range is found, the range is erased from the maple tree\nbefore dropping the lock, so each successful scan makes progress without\ndepending on any GFP_ATOMIC allocation.\n\nWith the same failslab settings, the fixed kernel completed\n\"kublk del -n $dev_id\" successfully in about 45 ms."
                }
            ],
            "affected": [
                {
                    "product": "Linux",
                    "vendor": "Linux",
                    "defaultStatus": "unaffected",
                    "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                    "programFiles": [
                        "drivers/block/ublk_drv.c"
                    ],
                    "versions": [
                        {
                            "version": "309e02dccf64e1b7bd2067abedc270e33b0aadf3",
                            "lessThan": "b9cc6cc74daf6fef533dbe65d8cee779fea69600",
                            "status": "affected",
                            "versionType": "git"
                        },
                        {
                            "version": "309e02dccf64e1b7bd2067abedc270e33b0aadf3",
                            "lessThan": "4fd66a7f829f3f38f92a79081f0f2688aed644f0",
                            "status": "affected",
                            "versionType": "git"
                        }
                    ]
                },
                {
                    "product": "Linux",
                    "vendor": "Linux",
                    "defaultStatus": "affected",
                    "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                    "programFiles": [
                        "drivers/block/ublk_drv.c"
                    ],
                    "versions": [
                        {
                            "version": "7.1",
                            "status": "affected"
                        },
                        {
                            "version": "0",
                            "lessThan": "7.1",
                            "status": "unaffected",
                            "versionType": "semver"
                        },
                        {
                            "version": "7.2.6",
                            "lessThanOrEqual": "7.2.*",
                            "status": "unaffected",
                            "versionType": "semver"
                        },
                        {
                            "version": "7.3",
                            "lessThanOrEqual": "*",
                            "status": "unaffected",
                            "versionType": "original_commit_for_fix"
                        }
                    ]
                }
            ],
            "cpeApplicability": [
                {
                    "nodes": [
                        {
                            "operator": "OR",
                            "negate": false,
                            "cpeMatch": [
                                {
                                    "vulnerable": true,
                                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                                    "versionStartIncluding": "7.1",
                                    "versionEndExcluding": "7.2.6"
                                },
                                {
                                    "vulnerable": true,
                                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                                    "versionStartIncluding": "7.1",
                                    "versionEndExcluding": "7.3"
                                }
                            ]
                        }
                    ]
                }
            ],
            "references": [
                {
                    "url": "https://git.kernel.org/stable/c/b9cc6cc74daf6fef533dbe65d8cee779fea69600"
                },
                {
                    "url": "https://git.kernel.org/stable/c/4fd66a7f829f3f38f92a79081f0f2688aed644f0"
                }
            ],
            "title": "ublk: avoid teardown retry loop on xarray allocation failure",
            "x_generator": {
                "engine": "bippy-1.2.0"
            }
        }
    }
}