CVE-2026-90180

A flaw was found in the Linux kernel's mtip32xx block device driver. A local user with access to an already open block device could exploit a synchronization issue between ioctl handlers and device removal. This could lead to a use-after-free vulnerability, where the system attempts to access memory that has already been released. The most direct consequence of this flaw is a system crash, resulting in a Denial of Service (DoS).

A race in the mtip32xx block driver can allow an ioctl path to continue after device removal has started. The ioctl handler checked REMOVE_PENDING before entering mtip_hw_ioctl, but removal could set the flag immediately afterward and free the port data in mtip_hw_exit while the in flight ioctl still dereferenced it. For the CVSS the PR:L is selected because a local process with access to an already-open block device or delegated device node permissions may reach the ioctl handler, while reliable triggering still depends on the device removal race. The issue is not network reachable. Impact is at least kernel crash DoS.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.