UBUNTU-CVE-2026-90185: Low severity ubuntu/linux-hwe-edge vulnerability
In the Linux kernel, the following vulnerability has been resolved: nullblk: serialize configfs attribute stores with the lock The NULLBDEVICEATTR store takes no lock: applyfn attributes (submitqueues, pollqueues) get dev->NAME written again after applyfn returns, outside its lock; APPLY=NULL attributes are entirely lockless. configfs only serializes stores per-open-file, so concurrent stores on separate fds race. For applyfn attributes, once one store's applyfn has reconfigured the hardware, a second (losing) store can still overwrite dev->NAME afterwards. This leaves dev->submitqueues out of sync with the live queue count, which is later caught by the WARNONONCE() in nullmapqueues(). For !applyfn attributes, powerstore()'s nulladddev() validates and builds the device under "lock" but only sets CONFIGURED afterwards. A store slipping in during this window can change a field mid-setup -- for example, zonenrconv can be pushed above nrzones after it has already been clamped, leading to an out-of-bounds dev->zones[] access. Take "lock" in the macro around the applyfn call, the CONFIGURED test and the field write, and move it out of nullbapplysubmitqueues()/ nullbapplypollqueues() so both paths are covered once. This serializes stores with powerstore's setup and with each other.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-42.42 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1016.17 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1016.18 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1015.16 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1 - Compensating control
In the NULLB_DEVICE_ATTR _store path, serialize configfs attribute stores with the device lock: hold the lock around the apply_fn call, the CONFIGURED test, and the field write, and move locking out of nullb_apply_submit_queues() and nullb_apply_poll_queues() so both apply_fn and non-apply_fn paths are covered.