UBUNTU-CVE-2026-90188: Low severity ubuntu/linux-azure vulnerability
In the Linux kernel, the following vulnerability has been resolved: nullblk: free global tagset on init error path If sharedtags is enabled, nullsetuptagset() allocates the global tagset via nullinitglobaltagset(). If device creation later fails, errdev destroys the default devices and calls unregisterblkdev(), but never frees the global tagset. Since module init failed, nullexit() is never invoked, so the global tagset's tags and maps are permanently leaked. Free the global tagset in errdev, matching nullexit() which does if (tagset.ops) blkmqfreetagset(&tagset).
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-42.42 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1016.17 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1016.18 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1015.16 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1
Event History
Frequently Asked Questions
Which Ubuntu kernel packages are listed as affected?
The listed packages are ubuntu/linux, ubuntu/linux-azure, ubuntu/linux-aws-fips, ubuntu/linux-azure-fips, ubuntu/linux-fips, ubuntu/linux-gcp-fips, ubuntu/linux-gcp, and ubuntu/linux-oracle.
What conditions are required for the leak to occur?
The null_blk module must be initialized with shared_tags enabled, allowing allocation of the global tag_set. A later device-creation failure during module initialization must then occur, causing initialization to exit without invoking the normal module cleanup path.