CVE-2026-90189

A flaw was found in the Linux kernel's null_blk component. A race condition can occur when the configfs subsystem is registered before default devices are created. This allows a local attacker, by performing a specific sequence of operations, to trigger a Use-After-Free (UAF) vulnerability. This could lead to system instability or potentially allow for privilege escalation.

null_blk registered the configfs subsystem before the block major and default devices were fully initialized. A local race with configfs mkdir and poweron during module load can reach null_add_dev while null_major is still zero, causing a WARN and failed disk registration. The more serious path is the error cleanup path, where a user created null_blk device can be freed while its configfs item remains reachable. Later userspace access to that item can trigger a use after free in kernel memory. For the CVSS the PR:L reflects a conservative deployment where a less trusted local service, reduced capability root, or delegated configfs control can create and power on null_blk devices while module initialization is in progress. The issue is not network reachable. Impact is at least local denial of service via warning or crash and in worst case may allow confidentiality or integrity impact due to the UAF primitive.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.