CVE-2026-90206 (GCVE-0-2026-90206)

Vulnerability from cvelistv5 – Published: 2026-09-17 16:07 – Updated: 2026-09-17 16:07
VLAI
Title
nvmet: fix max_qid race between configfs and controller allocation
Summary
In the Linux kernel, the following vulnerability has been resolved: nvmet: fix max_qid race between configfs and controller allocation The function nvmet_subsys_attr_qid_max_store() can race against nvmet_alloc_ctrl() when a subsystem's max_qid limit is modified. Suppose max_qid is currently 64. If nvmet_alloc_ctrl() executes: ctrl->sqs = kzalloc_objs(struct nvmet_sq *, subsys->max_qid + 1); and at this exact point, a userspace process changes max_qid to 128, nvmet_subsys_attr_qid_max_store() will set the new max_qid value. It attempts to delete active controllers to force a reconnect, but the new controller won't be deleted because it hasn't been added to the subsys->ctrls list yet. nvmet_alloc_ctrl() then proceeds and adds the new controller to the subsys->ctrls list. Later, when nvmet_install_queue() is called, it will see max_qid set to 128, but the memory allocated for sqs is only sized for 64 entries. This results in a KASAN out-of-bounds warning and potential memory corruptions. Fix this by protecting the queue allocations and list insertion in nvmet_alloc_ctrl() with down_read(&nvmet_config_sem). Because nvmet_subsys_attr_qid_max_store() acquires down_write(&nvmet_config_sem) to modify the attribute, this safely prevents the configfs writer from modifying max_qid during controller creation. Copy the max_qid from the subsystem to the controller's structure during the allocation; ctrl->max_qid never changes as long as the controller remains in LIVE state, so this will prevent similar race conditions.
Severity
No CVSS data available.
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 3e980f5995e0bb4d86fef873a9c9ad66721580d0 , < 2c23fc91789dfd9db746edb3ae9b90d65fabd410 (git)
Affected: 3e980f5995e0bb4d86fef873a9c9ad66721580d0 , < f1a8846e06388113dfdbb89dee005083fa9afdf9 (git)
guessed Create a notification for this product.
Linux Linux Affected: 6.1
Unaffected: 0 , < 6.1 (semver)
Unaffected: 7.2.6 , ≤ 7.2.* (semver)
Unaffected: 7.3-rc1 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/nvme/target/admin-cmd.c",
            "drivers/nvme/target/core.c",
            "drivers/nvme/target/fabrics-cmd.c",
            "drivers/nvme/target/nvmet.h",
            "drivers/nvme/target/pci-epf.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "2c23fc91789dfd9db746edb3ae9b90d65fabd410",
              "status": "affected",
              "version": "3e980f5995e0bb4d86fef873a9c9ad66721580d0",
              "versionType": "git"
            },
            {
              "lessThan": "f1a8846e06388113dfdbb89dee005083fa9afdf9",
              "status": "affected",
              "version": "3e980f5995e0bb4d86fef873a9c9ad66721580d0",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/nvme/target/admin-cmd.c",
            "drivers/nvme/target/core.c",
            "drivers/nvme/target/fabrics-cmd.c",
            "drivers/nvme/target/nvmet.h",
            "drivers/nvme/target/pci-epf.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.1"
            },
            {
              "lessThan": "6.1",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.6",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.3-rc1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2.6",
                  "versionStartIncluding": "6.1",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.3-rc1",
                  "versionStartIncluding": "6.1",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnvmet: fix max_qid race between configfs and controller allocation\n\nThe function nvmet_subsys_attr_qid_max_store() can race against\nnvmet_alloc_ctrl() when a subsystem\u0027s max_qid limit is modified.\n\nSuppose max_qid is currently 64. If nvmet_alloc_ctrl() executes:\nctrl-\u003esqs = kzalloc_objs(struct nvmet_sq *, subsys-\u003emax_qid + 1);\nand at this exact point, a userspace process changes max_qid to 128,\nnvmet_subsys_attr_qid_max_store() will set the new max_qid value. It\nattempts to delete active controllers to force a reconnect, but the\nnew controller won\u0027t be deleted because it hasn\u0027t been added to the\nsubsys-\u003ectrls list yet.\n\nnvmet_alloc_ctrl() then proceeds and adds the new controller to the\nsubsys-\u003ectrls list. Later, when nvmet_install_queue() is called, it\nwill see max_qid set to 128, but the memory allocated for sqs is only\nsized for 64 entries. This results in a KASAN out-of-bounds warning\nand potential memory corruptions.\n\nFix this by protecting the queue allocations and list insertion in\nnvmet_alloc_ctrl() with down_read(\u0026nvmet_config_sem). Because\nnvmet_subsys_attr_qid_max_store() acquires down_write(\u0026nvmet_config_sem)\nto modify the attribute, this safely prevents the configfs writer from\nmodifying max_qid during controller creation.\n\nCopy the max_qid from the subsystem to the controller\u0027s structure\nduring the allocation; ctrl-\u003emax_qid never changes as long as the\ncontroller remains in LIVE state, so this will prevent similar race\nconditions."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-17T16:07:22.173Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/2c23fc91789dfd9db746edb3ae9b90d65fabd410"
        },
        {
          "url": "https://git.kernel.org/stable/c/f1a8846e06388113dfdbb89dee005083fa9afdf9"
        }
      ],
      "title": "nvmet: fix max_qid race between configfs and controller allocation",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-90206",
    "datePublished": "2026-09-17T16:07:22.173Z",
    "dateReserved": "2026-09-11T19:38:34.793Z",
    "dateUpdated": "2026-09-17T16:07:22.173Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-90206",
      "date": "2026-09-25",
      "epss": "0.00198",
      "percentile": "0.08485"
    },
    "microsoft_vex": {
      "current_release_date": "2026-09-23T02:18:00.000Z",
      "cve": "CVE-2026-90206",
      "id": "msrc_CVE-2026-90206",
      "initial_release_date": "2026-09-19T01:16:51.000Z",
      "product_status:known_affected": "2",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "nvmet: fix max_qid race between configfs and controller allocation",
      "url": "https://msrc.microsoft.com/csaf/vex/2026/msrc_cve-2026-90206.json",
      "version": "2"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "drivers/nvme/target/admin-cmd.c",
                  "drivers/nvme/target/core.c",
                  "drivers/nvme/target/fabrics-cmd.c",
                  "drivers/nvme/target/nvmet.h",
                  "drivers/nvme/target/pci-epf.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "2c23fc91789dfd9db746edb3ae9b90d65fabd410",
                    "status": "affected",
                    "version": "3e980f5995e0bb4d86fef873a9c9ad66721580d0",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "f1a8846e06388113dfdbb89dee005083fa9afdf9",
                    "status": "affected",
                    "version": "3e980f5995e0bb4d86fef873a9c9ad66721580d0",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "drivers/nvme/target/admin-cmd.c",
                  "drivers/nvme/target/core.c",
                  "drivers/nvme/target/fabrics-cmd.c",
                  "drivers/nvme/target/nvmet.h",
                  "drivers/nvme/target/pci-epf.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "6.1"
                  },
                  {
                    "lessThan": "6.1",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "7.2.*",
                    "status": "unaffected",
                    "version": "7.2.6",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "7.3-rc1",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnvmet: fix max_qid race between configfs and controller allocation\n\nThe function nvmet_subsys_attr_qid_max_store() can race against\nnvmet_alloc_ctrl() when a subsystem\u0027s max_qid limit is modified.\n\nSuppose max_qid is currently 64. If nvmet_alloc_ctrl() executes:\nctrl-\u003esqs = kzalloc_objs(struct nvmet_sq *, subsys-\u003emax_qid + 1);\nand at this exact point, a userspace process changes max_qid to 128,\nnvmet_subsys_attr_qid_max_store() will set the new max_qid value. It\nattempts to delete active controllers to force a reconnect, but the\nnew controller won\u0027t be deleted because it hasn\u0027t been added to the\nsubsys-\u003ectrls list yet.\n\nnvmet_alloc_ctrl() then proceeds and adds the new controller to the\nsubsys-\u003ectrls list. Later, when nvmet_install_queue() is called, it\nwill see max_qid set to 128, but the memory allocated for sqs is only\nsized for 64 entries. This results in a KASAN out-of-bounds warning\nand potential memory corruptions.\n\nFix this by protecting the queue allocations and list insertion in\nnvmet_alloc_ctrl() with down_read(\u0026nvmet_config_sem). Because\nnvmet_subsys_attr_qid_max_store() acquires down_write(\u0026nvmet_config_sem)\nto modify the attribute, this safely prevents the configfs writer from\nmodifying max_qid during controller creation.\n\nCopy the max_qid from the subsystem to the controller\u0027s structure\nduring the allocation; ctrl-\u003emax_qid never changes as long as the\ncontroller remains in LIVE state, so this will prevent similar race\nconditions."
          }
        ],
        "id": "CVE-2026-90206",
        "lastModified": "2026-09-17T17:17:15.700",
        "metrics": {},
        "published": "2026-09-17T17:17:15.700",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/2c23fc91789dfd9db746edb3ae9b90d65fabd410"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/f1a8846e06388113dfdbb89dee005083fa9afdf9"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Received"
      }
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-09-21T16:30:47Z",
      "cve": "CVE-2026-90206",
      "id": "CVE-2026-90206",
      "initial_release_date": "2026-09-18T00:19:57Z",
      "product_status:known_affected": "230",
      "product_status:known_not_affected": "117",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-90206",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-90206.json",
      "version": "4"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.