{
  "affected": [
    {
      "ranges": [
        {
          "events": [
            {
              "introduced": "309e02dccf64e1b7bd2067abedc270e33b0aadf3"
            },
            {
              "fixed": "b9cc6cc74daf6fef533dbe65d8cee779fea69600"
            },
            {
              "fixed": "4fd66a7f829f3f38f92a79081f0f2688aed644f0"
            }
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "type": "GIT"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Linux",
        "name": "Kernel"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "7.1.0"
            },
            {
              "fixed": "7.2.6"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "database_specific": {
    "cna_assigner": "Linux",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/90xxx/CVE-2026-90181.json"
  },
  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nublk: avoid teardown retry loop on xarray allocation failure\n\n__ublk_shmem_remove_ranges() removes matching maple tree ranges in\nbatches, but first stores each range into a temporary xarray so that the\npages can be unpinned after dropping the maple tree lock.\n\nThat temporary xarray is filled under the maple tree lock with\nxa_store(..., GFP_ATOMIC). If the store fails before mas_erase(), the\ncurrent range is left in the tree and the helper returns false. The\nouter ublk_shmem_remove_ranges() loop then immediately retries the same\nrange. While the atomic allocation keeps failing, the teardown path has\nno forward progress.\n\nThe issue can be reproduced with radix_tree_node failslab injection after\na SHMEM_ZC buffer has already been registered:\n\n  # Kernel config:\n  #   CONFIG_BLK_DEV_UBLK=y\n  #   CONFIG_DEBUG_FS=y\n  #   CONFIG_FAULT_INJECTION=y\n  #   CONFIG_FAULT_INJECTION_DEBUG_FS=y\n  #   CONFIG_FAILSLAB=y\n\n  echo 10 \u003e /proc/sys/vm/nr_hugepages\n  mkdir -p /tmp/htlb\n  mount -t hugetlbfs none /tmp/htlb\n  fallocate -l 4M /tmp/htlb/ublk_buf\n\n  dev_id=$(kublk add -t null --shmem_zc \\\n\t\t--htlb /tmp/htlb/ublk_buf |\n\t   awk -F '[ :]' '/dev id/ {print $3}')\n\n  echo 1 \u003e /sys/kernel/slab/radix_tree_node/failslab\n  echo Y \u003e /sys/kernel/debug/failslab/cache-filter\n  echo Y \u003e /sys/kernel/debug/failslab/ignore-gfp-wait\n  echo 1 \u003e /sys/kernel/debug/failslab/interval\n  echo -1 \u003e /sys/kernel/debug/failslab/times\n  echo 100 \u003e /sys/kernel/debug/failslab/probability\n\n  kublk del -n \"$dev_id\"\n\nOn the unfixed kernel the delete command was still running after 3\nseconds. Disabling failslab made it return. The fault-injection stack\nshowed:\n\n  should_failslab\n  kmem_cache_alloc_lru_noprof\n  __xas_nomem\n  __xa_store\n  xa_store\n  __ublk_shmem_remove_ranges\n  ublk_cdev_rel\n  ublk_ctrl_del_dev\n\nRemove the allocation from the teardown loop. Keep the existing batch\nlimit, but collect {base_pfn, nr_pages} pairs in a fixed-size stack array.\nOnce a matching range is found, the range is erased from the maple tree\nbefore dropping the lock, so each successful scan makes progress without\ndepending on any GFP_ATOMIC allocation.\n\nWith the same failslab settings, the fixed kernel completed\n\"kublk del -n $dev_id\" successfully in about 45 ms.",
  "id": "CVE-2026-90181",
  "modified": "2026-09-19T03:30:57.722119113Z",
  "published": "2026-09-17T16:07:05.725Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/4fd66a7f829f3f38f92a79081f0f2688aed644f0"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/b9cc6cc74daf6fef533dbe65d8cee779fea69600"
    },
    {
      "type": "ADVISORY",
      "url": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/90xxx/CVE-2026-90181.json"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-90181"
    },
    {
      "type": "PACKAGE",
      "url": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git"
    }
  ],
  "schema_version": "1.9.0",
  "summary": "ublk: avoid teardown retry loop on xarray allocation failure"
}