{
  "cveId": "CVE-2026-90206",
  "url": "https://patchblox.com/security/cve/CVE-2026-90206",
  "summary": "CVE-2026-90206 is fixed in linux on 1 platform, first by DEBIAN-CVE-2026-90206, released September 23, 2026. It is not reported as exploited. Patch Radar priority: Routine.",
  "title": "nvmet: fix max_qid race between configfs and controller allocation",
  "description": "In the Linux kernel, the following vulnerability has been resolved:  nvmet: fix max_qid race between configfs and controller allocation  The function nvmet_subsys_attr_qid_max_store() can race against nvmet_alloc_ctrl() when a subsystem\u0027s max_qid limit is modified.  Suppose max_qid is currently 64. If nvmet_alloc_ctrl() executes: ctrl-\u003Esqs = kzalloc_objs(struct nvmet_sq *, subsys-\u003Emax_qid \u002B 1); and at this exact point, a userspace process changes max_qid to 128, nvmet_subsys_attr_qid_max_store() will set the new max_qid value. It attempts to delete active controllers to force a reconnect, but the new controller won\u0027t be deleted because it hasn\u0027t been added to the subsys-\u003Ectrls list yet.  nvmet_alloc_ctrl() then proceeds and adds the new controller to the subsys-\u003Ectrls list. Later, when nvmet_install_queue() is called, it will see max_qid set to 128, but the memory allocated for sqs is only sized for 64 entries. This results in a KASAN out-of-bounds warning and potential memory corruptions.  Fix this by protecting the queue allocations and list insertion in nvmet_alloc_ctrl() with down_read(\u0026nvmet_config_sem). Because nvmet_subsys_attr_qid_max_store() acquires down_write(\u0026nvmet_config_sem) to modify the attribute, this safely prevents the configfs writer from modifying max_qid during controller creation.  Copy the max_qid from the subsystem to the controller\u0027s structure during the allocation; ctrl-\u003Emax_qid never changes as long as the controller remains in LIVE state, so this will prevent similar race conditions.",
  "published": "2026-09-17T17:17:15Z",
  "severity": "Moderate",
  "cvss": 6.3,
  "epss": 0.00206,
  "epssPercentile": 0.10729,
  "priority": "Routine",
  "priorityTier": 4,
  "exploited": false,
  "vendorExploited": false,
  "disclosed": false,
  "vendorAdvisory": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-90206",
  "fixes": [
    {
      "platform": "linux",
      "product": "linux",
      "release": "Debian 13.5 (trixie)",
      "fixedVersion": "6.12.115-2",
      "fix": "DEBIAN-CVE-2026-90206",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2026-90206",
      "released": "2026-09-23T19:19:02Z"
    },
    {
      "platform": "linux",
      "product": "linux",
      "release": "Debian 14",
      "fixedVersion": "7.2.6-1",
      "fix": "DEBIAN-CVE-2026-90206",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2026-90206",
      "released": "2026-09-23T19:19:02Z"
    }
  ],
  "noFixYet": [],
  "dataAsOf": "2026-11-08T19:12:23Z",
  "attribution": {
    "text": "Data: Patchblox Patch Radar",
    "url": "https://patchblox.com/security/patch-radar",
    "terms": "https://patchblox.com/security/patch-radar/use-the-data"
  }
}