CVE-2026-90206

In the Linux kernel, the following vulnerability has been resolved: nvmet: fix max_qid race between configfs and controller allocation The function nvmet_subsys_attr_qid_max_store() can race against nvmet_alloc_ctrl() when a subsystem's max_qid limit is modified. Suppose max_qid is currently 64. If nvmet_alloc_ctrl() executes: ctrl->sqs = kzalloc_objs(struct nvmet_sq *, subsys->max_qid + 1); and at this exact point, a userspace process changes max_qid to 128, nvmet_subsys_attr_qid_max_store() will set the new max_qid value. It attempts to delete active controllers to force a reconnect, but the new controller won't be deleted because it hasn't been added to the subsys->ctrls list yet. nvmet_alloc_ctrl() then proceeds and adds the new controller to the subsys->ctrls list. Later, when nvmet_install_queue() is called, it will see max_qid set to 128, but the memory allocated for sqs is only sized for 64 entries. This results in a KASAN out-of-bounds warning and potential memory corruptions. Fix this by protecting the queue allocations and list insertion in nvmet_alloc_ctrl() with down_read(&nvmet_config_sem). Because nvmet_subsys_attr_qid_max_store() acquires down_write(&nvmet_config_sem) to modify the attribute, this safely prevents the configfs writer from modifying max_qid during controller creation. Copy the max_qid from the subsystem to the controller's structure during the allocation; ctrl->max_qid never changes as long as the controller remains in LIVE state, so this will prevent similar race conditions.

• https://git.kernel.org/stable/c/2c23fc91789dfd9db746edb3ae9b90d65fabd410
• https://git.kernel.org/stable/c/f1a8846e06388113dfdbb89dee005083fa9afdf9

Published

Sep 17, 2026

Last Modified

Sep 17, 2026

Status

Received

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-90200In the Linux kernel, the following vulnerability has been re…
• CVE-2026-90201In the Linux kernel, the following vulnerability has been re…
• CVE-2026-90202In the Linux kernel, the following vulnerability has been re…
• CVE-2026-90203In the Linux kernel, the following vulnerability has been re…7.1
• CVE-2026-90204In the Linux kernel, the following vulnerability has been re…7.8
• CVE-2026-90205In the Linux kernel, the following vulnerability has been re…7.8
• CVE-2026-90207In the Linux kernel, the following vulnerability has been re…7.8
• CVE-2026-90208In the Linux kernel, the following vulnerability has been re…
• CVE-2026-90209In the Linux kernel, the following vulnerability has been re…
• CVE-2026-9021The Easy Invoice plugin for WordPress is vulnerable to Missi…5.3
• CVE-2026-90210In the Linux kernel, the following vulnerability has been re…7.8
• CVE-2026-90211In the Linux kernel, the following vulnerability has been re…