Skip to content
CVE PROGRAM SOURCE RECORDUnscored

CVE-2026-90180

block: mtip32xx: synchronize ioctls with device removal

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
Linux

Description

In the Linux kernel, the following vulnerability has been resolved: block: mtip32xx: synchronize ioctls with device removal The ioctl handlers only test REMOVE_PENDING before entering mtip_hw_ioctl(). Removal can set that bit immediately afterwards and free dd->port in mtip_hw_exit() while an ioctl still dereferences it. An already open block device can reach the handlers while del_gendisk() is in progress. Serialize both native and compat ioctls with removal. Set REMOVE_PENDING before taking the mutex so new callers fail after an in-flight ioctl has drained, and hold the mutex until the port has been torn down.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Linux Linux

Default version status: unaffected

  • 88523a61558a040546bf7d8b079ae0755d8e7005 to < 521afbd936ac256b7531470b0b9aa96abf9cd853affected
  • 88523a61558a040546bf7d8b079ae0755d8e7005 to < 8283049aa5fcb4e84b2b2928b2888903bb8ee12eaffected
  • 88523a61558a040546bf7d8b079ae0755d8e7005 to < 8a7799597bd683b6bc251fe2edfa9fd1db568a3aaffected
  • 88523a61558a040546bf7d8b079ae0755d8e7005 to < 4609e0e0be709e974bec9b52c5022136d25e97d3affected
  • 88523a61558a040546bf7d8b079ae0755d8e7005 to < b389dc35a55713ac24a145741e76196fea1663bcaffected
  • 88523a61558a040546bf7d8b079ae0755d8e7005 to < 68940f841d013192086a0f6d7cfbac2cd079e228affected

Linux Linux

Default version status: affected

  • 3.3affected
  • 0 to < 3.3unaffected
  • 6.1.188 to ≤ 6.1.*unaffected
  • 6.6.157 to ≤ 6.6.*unaffected
  • 6.12.110 to ≤ 6.12.*unaffected
  • 6.18.52 to ≤ 6.18.*unaffected
  • 7.2.6 to ≤ 7.2.*unaffected
  • 7.3 to ≤ *unaffected

References