{"id":"CVE-2026-90181","revision":"0153607d2c404538ba34e054130096c6","records":[{"revision":"0153607d2c404538ba34e054130096c6","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-90181","aliases":[],"title":"ublk: avoid teardown retry loop on xarray allocation failure","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nublk: avoid teardown retry loop on xarray allocation failure\n\n__ublk_shmem_remove_ranges() removes matching maple tree ranges in\nbatches, but first stores each range into a temporary xarray so that the\npages can be unpinned after dropping the maple tree lock.\n\nThat temporary xarray is filled under the maple tree lock with\nxa_store(..., GFP_ATOMIC). If the store fails before mas_erase(), the\ncurrent range is left in the tree and the helper returns false. The\nouter ublk_shmem_remove_ranges() loop then immediately retries the same\nrange. While the atomic allocation keeps failing, the teardown path has\nno forward progress.\n\nThe issue can be reproduced with radix_tree_node failslab injection after\na SHMEM_ZC buffer has already been registered:\n\n  # Kernel config:\n  #   CONFIG_BLK_DEV_UBLK=y\n  #   CONFIG_DEBUG_FS=y\n  #   CONFIG_FAULT_INJECTION=y\n  #   CONFIG_FAULT_INJECTION_DEBUG_FS=y\n  #   CONFIG_FAILSLAB=y\n\n  echo 10 > /proc/sys/vm/nr_hugepages\n  mkdir -p /tmp/htlb\n  mount -t hugetlbfs none /tmp/htlb\n  fallocate -l 4M /tmp/htlb/ublk_buf\n\n  dev_id=$(kublk add -t null --shmem_zc \\\n\t\t--htlb /tmp/htlb/ublk_buf |\n\t   awk -F '[ :]' '/dev id/ {print $3}')\n\n  echo 1 > /sys/kernel/slab/radix_tree_node/failslab\n  echo Y > /sys/kernel/debug/failslab/cache-filter\n  echo Y > /sys/kernel/debug/failslab/ignore-gfp-wait\n  echo 1 > /sys/kernel/debug/failslab/interval\n  echo -1 > /sys/kernel/debug/failslab/times\n  echo 100 > /sys/kernel/debug/failslab/probability\n\n  kublk del -n \"$dev_id\"\n\nOn the unfixed kernel the delete command was still running after 3\nseconds. Disabling failslab made it return. The fault-injection stack\nshowed:\n\n  should_failslab\n  kmem_cache_alloc_lru_noprof\n  __xas_nomem\n  __xa_store\n  xa_store\n  __ublk_shmem_remove_ranges\n  ublk_cdev_rel\n  ublk_ctrl_del_dev\n\nRemove the allocation from the teardown loop. Keep the existing batch\nlimit, but collect {base_pfn, nr_pages} pairs in a fixed-size stack array.\nOnce a matching range is found, the range is erased from the maple tree\nbefore dropping the lock, so each successful scan makes progress without\ndepending on any GFP_ATOMIC allocation.\n\nWith the same failslab settings, the fixed kernel completed\n\"kublk del -n $dev_id\" successfully in about 45 ms.","state":0,"publishedAt":"2026-09-17T16:07:05.725+00:00","modifiedAt":"2026-10-19T08:59:18.253+00:00","affected":[{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"unaffected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"drivers/block/ublk_drv.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"309e02dccf64e1b7bd2067abedc270e33b0aadf3\",\n                            \"lessThan\": \"b9cc6cc74daf6fef533dbe65d8cee779fea69600\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"309e02dccf64e1b7bd2067abedc270e33b0aadf3\",\n                            \"lessThan\": \"4fd66a7f829f3f38f92a79081f0f2688aed644f0\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        }\n                    ]\n                }"},{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"affected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"drivers/block/ublk_drv.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"7.1\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"0\",\n                            \"lessThan\": \"7.1\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"7.2.6\",\n                            \"lessThanOrEqual\": \"7.2.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"7.3\",\n                            \"lessThanOrEqual\": \"*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"original_commit_for_fix\"\n                        }\n                    ]\n                }"}],"metrics":[],"references":["https://git.kernel.org/stable/c/b9cc6cc74daf6fef533dbe65d8cee779fea69600","https://git.kernel.org/stable/c/4fd66a7f829f3f38f92a79081f0f2688aed644f0"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-90181","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-90181","identifiers":["CVE-2026-90181"]},"retained":false,"historicalAffected":[]}],"coverage":[]}