UBUNTU-CVE-2026-90189: Low severity ubuntu/linux-azure vulnerability
In the Linux kernel, the following vulnerability has been resolved: nullblk: register configfs subsystem after creating default devices In nullinit(), configfsregistersubsystem() currently runs before registerblkdev(), so when nullblk is built as a module, a racing mkdir() + poweron from userspace can reach nulladddev() while nullmajor is still 0. adddisk() then hits WARNON(disk->minors) (major=0 with minors!=0) and fails: [root@fedora ~]# [ 2366.521436] WARNING: block/genhd.c:476 at adddisk+0x8a7/0xde0, [ 2366.523552] Modules linked in: nullblk(+) nftfibinet nftfibipv4 nftfibipv6 nftfib [ 2366.529081] CPU: 26 UID: 0 PID: 1600 Comm: sh Not tainted 7.2.0-rc1+ #66 PREEMPT(full) ...... [ 2366.547251] Call Trace: [ 2366.547575] <TASK> [ 2366.547831] ? rawspinlock+0x84/0xe0 [ 2366.548260] adddiskfwnode+0x114/0x560 [ 2366.548739] nulladddev+0x102d/0x1b80 [nullblk] [ 2366.549310] ? pfxnulladddev+0x10/0x10 [nullblk] [ 2366.549906] ? mutexlock+0xde/0x1c0 [ 2366.550361] ? pfxmutexlock+0x10/0x10 [ 2366.550827] nullbdevicepowerstore+0x1e7/0x280 [nullblk] [ 2366.551499] ? pfxnullbdevicepowerstore+0x10/0x10 [nullblk] [ 2366.552177] ? kmalloccachenoprof+0x1f5/0x470 [ 2366.552748] ? configfswriteiter+0x35c/0x4e0 [ 2366.553242] configfswriteiter+0x286/0x4e0 [ 2366.553787] vfswrite+0x52d/0xd00 [ 2366.554169] ? pfxvfswrite+0x10/0x10 [ 2366.554679] ? pfxcssrstatupdated+0x10/0x10 [ 2366.555196] ? fdgetpos+0x1cf/0x4c0 [ 2366.555649] ksyswrite+0xfc/0x1d0 ...... Additionally, the errdev path destroys all devices on nullblist while configfs is still registered. If a racing mkdir() + poweron puts a user device on the list, nulldestroydev()->nullfreedev() kfrees the user device's nullbdevice but /sys/kernel/config/nullb/<name> is still reachable. Any userspace access to the item will trigger a UAF. For simplicity, move configfsregistersubsystem() to the end to solve the problems above.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-42.42 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1016.17 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1016.18 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1015.16 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1 - Configuration
Move configfs_register_subsystem() to the end of null_init(), after register_blkdev() and creation of the default devices, so userspace cannot access configfs while null_major is still 0 or devices are not fully initialized.
Linux kernel null_blk configfs_register_subsystem() registration order = register after register_blkdev() and after creating default devices
Event History
Frequently Asked Questions
Who is exposed to this issue?
Systems using the null_blk kernel module are exposed when it is built and loaded as a module. The affected Ubuntu kernel packages listed are linux, linux-azure, linux-azure-fips, linux-aws-fips, linux-fips, linux-gcp, linux-gcp-fips, and linux-oracle.
What is required to trigger the problem?
A userspace race is required during null_blk initialization: creating a configfs device directory and powering it on before block-device registration has completed. The provided reproducer context shows this being performed as root.
How can I recognize that the issue has occurred?
The kernel can emit a WARNING from __add_disk(), reporting WARN_ON(disk->minors), when null_blk attempts to add a disk with major number 0 and nonzero minors. The call trace includes null_add_dev and nullb_device_power_store from the null_blk module.