FKIE_CVE-2026-90180

Vulnerability from fkie_nvd - Published: 2026-09-17 17:17 - Updated: 2026-09-17 17:17
Severity
Summary
In the Linux kernel, the following vulnerability has been resolved: block: mtip32xx: synchronize ioctls with device removal The ioctl handlers only test REMOVE_PENDING before entering mtip_hw_ioctl(). Removal can set that bit immediately afterwards and free dd->port in mtip_hw_exit() while an ioctl still dereferences it. An already open block device can reach the handlers while del_gendisk() is in progress. Serialize both native and compat ioctls with removal. Set REMOVE_PENDING before taking the mutex so new callers fail after an in-flight ioctl has drained, and hold the mutex until the port has been torn down.
References
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/4609e0e0be709e974bec9b52c5022136d25e97d3
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/521afbd936ac256b7531470b0b9aa96abf9cd853
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/68940f841d013192086a0f6d7cfbac2cd079e228
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/8283049aa5fcb4e84b2b2928b2888903bb8ee12e
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/8a7799597bd683b6bc251fe2edfa9fd1db568a3a
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/b389dc35a55713ac24a145741e76196fea1663bc
Impacted products
Vendor Product Version
To clipboard 

{
  "affected": [
    {
      "affectedData": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/block/mtip32xx/mtip32xx.c",
            "drivers/block/mtip32xx/mtip32xx.h"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "521afbd936ac256b7531470b0b9aa96abf9cd853",
              "status": "affected",
              "version": "88523a61558a040546bf7d8b079ae0755d8e7005",
              "versionType": "git"
            },
            {
              "lessThan": "8283049aa5fcb4e84b2b2928b2888903bb8ee12e",
              "status": "affected",
              "version": "88523a61558a040546bf7d8b079ae0755d8e7005",
              "versionType": "git"
            },
            {
              "lessThan": "8a7799597bd683b6bc251fe2edfa9fd1db568a3a",
              "status": "affected",
              "version": "88523a61558a040546bf7d8b079ae0755d8e7005",
              "versionType": "git"
            },
            {
              "lessThan": "4609e0e0be709e974bec9b52c5022136d25e97d3",
              "status": "affected",
              "version": "88523a61558a040546bf7d8b079ae0755d8e7005",
              "versionType": "git"
            },
            {
              "lessThan": "b389dc35a55713ac24a145741e76196fea1663bc",
              "status": "affected",
              "version": "88523a61558a040546bf7d8b079ae0755d8e7005",
              "versionType": "git"
            },
            {
              "lessThan": "68940f841d013192086a0f6d7cfbac2cd079e228",
              "status": "affected",
              "version": "88523a61558a040546bf7d8b079ae0755d8e7005",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/block/mtip32xx/mtip32xx.c",
            "drivers/block/mtip32xx/mtip32xx.h"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "3.3"
            },
            {
              "lessThan": "3.3",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.188",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.157",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.110",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.52",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.6",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.3-rc1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nblock: mtip32xx: synchronize ioctls with device removal\n\nThe ioctl handlers only test REMOVE_PENDING before entering\nmtip_hw_ioctl(). Removal can set that bit immediately afterwards and free\ndd-\u003eport in mtip_hw_exit() while an ioctl still dereferences it. An already\nopen block device can reach the handlers while del_gendisk() is in\nprogress.\n\nSerialize both native and compat ioctls with removal. Set REMOVE_PENDING\nbefore taking the mutex so new callers fail after an in-flight ioctl has\ndrained, and hold the mutex until the port has been torn down."
    }
  ],
  "id": "CVE-2026-90180",
  "lastModified": "2026-09-17T17:17:12.123",
  "metrics": {},
  "published": "2026-09-17T17:17:12.123",
  "references": [
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/4609e0e0be709e974bec9b52c5022136d25e97d3"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/521afbd936ac256b7531470b0b9aa96abf9cd853"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/68940f841d013192086a0f6d7cfbac2cd079e228"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/8283049aa5fcb4e84b2b2928b2888903bb8ee12e"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/8a7799597bd683b6bc251fe2edfa9fd1db568a3a"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/b389dc35a55713ac24a145741e76196fea1663bc"
    }
  ],
  "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
  "vulnStatus": "Received"
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.