CVE-2026-90180: block: mtip32xx: synchronize ioctls with device removal
In the Linux kernel, the following vulnerability has been resolved:
block: mtip32xx: synchronize ioctls with device removal
The ioctl handlers only test REMOVEPENDING before entering mtiphwioctl(). Removal can set that bit immediately afterwards and free dd->port in mtiphwexit() while an ioctl still dereferences it. An already open block device can reach the handlers while delgendisk() is in progress.
Serialize both native and compat ioctls with removal. Set REMOVEPENDING before taking the mutex so new callers fail after an in-flight ioctl has drained, and hold the mutex until the port has been torn down.
Event History
Frequently Asked Questions
Who is exposed to this issue?
Systems using the Linux kernel mtip32xx block driver are exposed when a block device remains open while device removal and ioctl handling can overlap.
What does an attacker or triggering process need to do?
A process needs an already open affected block device and must issue a native or compat ioctl while removal is in progress. The race can allow an ioctl to dereference dd->port after it has been freed.
Are new ioctl callers blocked during removal after the fix?
Yes. The fix sets REMOVE_PENDING before taking the mutex, causing new ioctl callers to fail after any in-flight ioctl has drained.
How does the fix prevent the use-after-free condition?
It serializes both native and compat ioctls with device removal and holds the mutex until the port teardown is complete.