CVE-2026-90206: Linux kernel · nvmet: fix max_qid race between configfs and controller allocation
Affects Linux kernelSource CVE Database V5
Not known to be exploited · fixed in f1a8846e06388113dfdbb89dee005083fa9afdf9 : update Linux kernel when convenient.
Data as of 26 Oct 2026, 12:55 UTC
Rated by Threat Radar · CVSS not yet scored by NVD
- EPSS
- 0.2% chance of exploitation in 30 days – higher than 10% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
- Patch
- Available – fixed in f1a8846e06388113dfdbb89dee005083fa9afdf9, af811970da4f0a928f5a1b1a946a04f755ce86f2, a1b88a1782eb6b368071dcda548a41b5c23d8cd2 +2
Exploitation evidence
Disclosed: evidence found.
CVE published 17 Sep 2026
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors
A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 26 Oct 2026.
What to do
Upgrade to a fixed release listed under Affected software.
Affected software
| Product | Affected | Fixed in |
|---|---|---|
| LinuxLinux | Affected
| Fixed in
|
| LinuxLinux | Affected
| Fixed in
|
| LinuxLinux | Affected
| Fixed in
|
| LinuxLinux | Affected
| Fixed in
|
| LinuxLinux | Affected
| Fixed in
|
| LinuxLinux | Affected
| Fixed in– |
Description
In the Linux kernel, the following vulnerability has been resolved: nvmet: fix max_qid race between configfs and controller allocation The function nvmet_subsys_attr_qid_max_store() can race against nvmet_alloc_ctrl() when a subsystem's max_qid limit is modified. Suppose max_qid is currently 64. If nvmet_alloc_ctrl() executes: ctrl->sqs = kzalloc_objs(struct nvmet_sq *, subsys->max_qid + 1); and at this exact point, a userspace process changes max_qid to 128, nvmet_subsys_attr_qid_max_store() will set the new max_qid value. It attempts to delete active controllers to force a reconnect, but the new controller won't be deleted because it hasn't been added to the subsys->ctrls list yet. nvmet_alloc_ctrl() then proceeds and adds the new controller to the subsys->ctrls list. Later, when nvmet_install_queue() is called, it will see max_qid set to 128, but the memory allocated for sqs is only sized for 64 entries. This results in a KASAN out-of-bounds warning and potential memory corruptions. Fix this by protecting the queue allocations and list insertion in nvmet_alloc_ctrl() with down_read(&nvmet_config_sem). Because nvmet_subsys_attr_qid_max_store() acquires down_write(&nvmet_config_sem) to modify the attribute, this safely prevents the configfs writer from modifying max_qid during controller creation. Copy the max_qid from the subsystem to the controller's structure during the allocation; ctrl->max_qid never changes as long as the controller remains in LIVE state, so this will prevent similar race conditions.
References
- git.kernel.org/stable/c/af811970da4f0a928f5a1b1a946a04f755ce86f2 (opens in a new tab)
- git.kernel.org/stable/c/a1b88a1782eb6b368071dcda548a41b5c23d8cd2 (opens in a new tab)
- git.kernel.org/stable/c/6e6f8e3bfc66dff1833a48ecfd857268cff3be84 (opens in a new tab)
- git.kernel.org/stable/c/2c23fc91789dfd9db746edb3ae9b90d65fabd410 (opens in a new tab)
- git.kernel.org/stable/c/f1a8846e06388113dfdbb89dee005083fa9afdf9 (opens in a new tab)