{"id":"CVE-2026-90206","state":"PUBLISHED","title":"nvmet: fix max_qid race between configfs and controller allocation","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nnvmet: fix max_qid race between configfs and controller allocation\n\nThe function nvmet_subsys_attr_qid_max_store() can race against\nnvmet_alloc_ctrl() when a subsystem's max_qid limit is modified.\n\nSuppose max_qid is currently 64. If nvmet_alloc_ctrl() executes:\nctrl->sqs = kzalloc_objs(struct nvmet_sq *, subsys->max_qid + 1);\nand at this exact point, a userspace process changes max_qid to 128,\nnvmet_subsys_attr_qid_max_store() will set the new max_qid value. It\nattempts to delete active controllers to force a reconnect, but the\nnew controller won't be deleted because it hasn't been added to the\nsubsys->ctrls list yet.\n\nnvmet_alloc_ctrl() then proceeds and adds the new controller to the\nsubsys->ctrls list. Later, when nvmet_install_queue() is called, it\nwill see max_qid set to 128, but the memory allocated for sqs is only\nsized for 64 entries. This results in a KASAN out-of-bounds warning\nand potential memory corruptions.\n\nFix this by protecting the queue allocations and list insertion in\nnvmet_alloc_ctrl() with down_read(&nvmet_config_sem). Because\nnvmet_subsys_attr_qid_max_store() acquires down_write(&nvmet_config_sem)\nto modify the attribute, this safely prevents the configfs writer from\nmodifying max_qid during controller creation.\n\nCopy the max_qid from the subsystem to the controller's structure\nduring the allocation; ctrl->max_qid never changes as long as the\ncontroller remains in LIVE state, so this will prevent similar race\nconditions.","publishedAt":"2026-09-17T16:07:22.173Z","updatedAt":"2026-10-30T12:34:46.536Z","severity":null,"assigner":"Linux","products":["Linux Linux"],"affected":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","versions":[{"version":"3e980f5995e0bb4d86fef873a9c9ad66721580d0","status":"affected","lessThan":"cae0f5ed6ce7af3f7e0003c417f1953a350f55bf","versionType":"git"},{"version":"3e980f5995e0bb4d86fef873a9c9ad66721580d0","status":"affected","lessThan":"af811970da4f0a928f5a1b1a946a04f755ce86f2","versionType":"git"},{"version":"3e980f5995e0bb4d86fef873a9c9ad66721580d0","status":"affected","lessThan":"a1b88a1782eb6b368071dcda548a41b5c23d8cd2","versionType":"git"},{"version":"3e980f5995e0bb4d86fef873a9c9ad66721580d0","status":"affected","lessThan":"6e6f8e3bfc66dff1833a48ecfd857268cff3be84","versionType":"git"},{"version":"3e980f5995e0bb4d86fef873a9c9ad66721580d0","status":"affected","lessThan":"2c23fc91789dfd9db746edb3ae9b90d65fabd410","versionType":"git"},{"version":"3e980f5995e0bb4d86fef873a9c9ad66721580d0","status":"affected","lessThan":"f1a8846e06388113dfdbb89dee005083fa9afdf9","versionType":"git"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/nvme/target/admin-cmd.c","drivers/nvme/target/core.c","drivers/nvme/target/fabrics-cmd.c","drivers/nvme/target/nvmet.h","drivers/nvme/target/pci-epf.c"]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","versions":[{"version":"6.1","status":"affected"},{"version":"0","status":"unaffected","lessThan":"6.1","versionType":"semver"},{"version":"6.1.191","status":"unaffected","lessThanOrEqual":"6.1.*","versionType":"semver"},{"version":"6.6.160","status":"unaffected","lessThanOrEqual":"6.6.*","versionType":"semver"},{"version":"6.12.114","status":"unaffected","lessThanOrEqual":"6.12.*","versionType":"semver"},{"version":"6.18.57","status":"unaffected","lessThanOrEqual":"6.18.*","versionType":"semver"},{"version":"7.2.6","status":"unaffected","lessThanOrEqual":"7.2.*","versionType":"semver"},{"version":"7.3","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/nvme/target/admin-cmd.c","drivers/nvme/target/core.c","drivers/nvme/target/fabrics-cmd.c","drivers/nvme/target/nvmet.h","drivers/nvme/target/pci-epf.c"]}],"references":["https://git.kernel.org/stable/c/cae0f5ed6ce7af3f7e0003c417f1953a350f55bf","https://git.kernel.org/stable/c/af811970da4f0a928f5a1b1a946a04f755ce86f2","https://git.kernel.org/stable/c/a1b88a1782eb6b368071dcda548a41b5c23d8cd2","https://git.kernel.org/stable/c/6e6f8e3bfc66dff1833a48ecfd857268cff3be84","https://git.kernel.org/stable/c/2c23fc91789dfd9db746edb3ae9b90d65fabd410","https://git.kernel.org/stable/c/f1a8846e06388113dfdbb89dee005083fa9afdf9"],"weaknesses":[],"ingestedAt":"2026-10-30T12:54:04.478Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2026/90xxx/CVE-2026-90206.json","commit":"1f312381e38164a43607eebab851b151dd16861e","baselineCommit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-90206","state":"PUBLISHED","datePublished":"2026-09-17T16:07:22.173Z","dateUpdated":"2026-10-30T12:34:46.536Z","assignerShortName":"Linux","assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","dateReserved":"2026-09-11T19:38:34.793Z"},"containers":{"cna":{"title":"nvmet: fix max_qid race between configfs and controller allocation","descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nnvmet: fix max_qid race between configfs and controller allocation\n\nThe function nvmet_subsys_attr_qid_max_store() can race against\nnvmet_alloc_ctrl() when a subsystem's max_qid limit is modified.\n\nSuppose max_qid is currently 64. If nvmet_alloc_ctrl() executes:\nctrl->sqs = kzalloc_objs(struct nvmet_sq *, subsys->max_qid + 1);\nand at this exact point, a userspace process changes max_qid to 128,\nnvmet_subsys_attr_qid_max_store() will set the new max_qid value. It\nattempts to delete active controllers to force a reconnect, but the\nnew controller won't be deleted because it hasn't been added to the\nsubsys->ctrls list yet.\n\nnvmet_alloc_ctrl() then proceeds and adds the new controller to the\nsubsys->ctrls list. Later, when nvmet_install_queue() is called, it\nwill see max_qid set to 128, but the memory allocated for sqs is only\nsized for 64 entries. This results in a KASAN out-of-bounds warning\nand potential memory corruptions.\n\nFix this by protecting the queue allocations and list insertion in\nnvmet_alloc_ctrl() with down_read(&nvmet_config_sem). Because\nnvmet_subsys_attr_qid_max_store() acquires down_write(&nvmet_config_sem)\nto modify the attribute, this safely prevents the configfs writer from\nmodifying max_qid during controller creation.\n\nCopy the max_qid from the subsystem to the controller's structure\nduring the allocation; ctrl->max_qid never changes as long as the\ncontroller remains in LIVE state, so this will prevent similar race\nconditions."}],"affected":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","versions":[{"version":"3e980f5995e0bb4d86fef873a9c9ad66721580d0","status":"affected","lessThan":"cae0f5ed6ce7af3f7e0003c417f1953a350f55bf","versionType":"git"},{"version":"3e980f5995e0bb4d86fef873a9c9ad66721580d0","status":"affected","lessThan":"af811970da4f0a928f5a1b1a946a04f755ce86f2","versionType":"git"},{"version":"3e980f5995e0bb4d86fef873a9c9ad66721580d0","status":"affected","lessThan":"a1b88a1782eb6b368071dcda548a41b5c23d8cd2","versionType":"git"},{"version":"3e980f5995e0bb4d86fef873a9c9ad66721580d0","status":"affected","lessThan":"6e6f8e3bfc66dff1833a48ecfd857268cff3be84","versionType":"git"},{"version":"3e980f5995e0bb4d86fef873a9c9ad66721580d0","status":"affected","lessThan":"2c23fc91789dfd9db746edb3ae9b90d65fabd410","versionType":"git"},{"version":"3e980f5995e0bb4d86fef873a9c9ad66721580d0","status":"affected","lessThan":"f1a8846e06388113dfdbb89dee005083fa9afdf9","versionType":"git"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/nvme/target/admin-cmd.c","drivers/nvme/target/core.c","drivers/nvme/target/fabrics-cmd.c","drivers/nvme/target/nvmet.h","drivers/nvme/target/pci-epf.c"]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","versions":[{"version":"6.1","status":"affected"},{"version":"0","status":"unaffected","lessThan":"6.1","versionType":"semver"},{"version":"6.1.191","status":"unaffected","lessThanOrEqual":"6.1.*","versionType":"semver"},{"version":"6.6.160","status":"unaffected","lessThanOrEqual":"6.6.*","versionType":"semver"},{"version":"6.12.114","status":"unaffected","lessThanOrEqual":"6.12.*","versionType":"semver"},{"version":"6.18.57","status":"unaffected","lessThanOrEqual":"6.18.*","versionType":"semver"},{"version":"7.2.6","status":"unaffected","lessThanOrEqual":"7.2.*","versionType":"semver"},{"version":"7.3","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/nvme/target/admin-cmd.c","drivers/nvme/target/core.c","drivers/nvme/target/fabrics-cmd.c","drivers/nvme/target/nvmet.h","drivers/nvme/target/pci-epf.c"]}],"references":[{"url":"https://git.kernel.org/stable/c/cae0f5ed6ce7af3f7e0003c417f1953a350f55bf"},{"url":"https://git.kernel.org/stable/c/af811970da4f0a928f5a1b1a946a04f755ce86f2"},{"url":"https://git.kernel.org/stable/c/a1b88a1782eb6b368071dcda548a41b5c23d8cd2"},{"url":"https://git.kernel.org/stable/c/6e6f8e3bfc66dff1833a48ecfd857268cff3be84"},{"url":"https://git.kernel.org/stable/c/2c23fc91789dfd9db746edb3ae9b90d65fabd410"},{"url":"https://git.kernel.org/stable/c/f1a8846e06388113dfdbb89dee005083fa9afdf9"}],"providerMetadata":{"shortName":"Linux","orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","dateUpdated":"2026-10-30T12:34:46.536Z"},"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.1","versionEndExcluding":"6.1.191"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.1","versionEndExcluding":"6.6.160"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.1","versionEndExcluding":"6.12.114"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.1","versionEndExcluding":"6.18.57"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.1","versionEndExcluding":"7.2.6"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.1","versionEndExcluding":"7.3"}]}]}],"x_generator":{"engine":"bippy-1.2.0"}}}}}