In the Linux kernel, the following vulnerability has been resolved:

null_blk: free global tag_set on init error path

If shared_tags is enabled, null_setup_tagset() allocates the global tag_set
via null_init_global_tag_set(). If device creation later fails, err_dev
destroys the default devices and calls unregister_blkdev(), but never frees
the global tag_set. Since module init failed, null_exit() is never invoked,
so the global tag_set's tags and maps are permanently leaked.

Free the global tag_set in err_dev, matching null_exit() which does
if (tag_set.ops) blk_mq_free_tag_set(&tag_set).

No CVSS v4.0

No CVSS v3.1

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

No EPSS score available.

Key SSVC decision points have not yet been added.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions
Linux Linux unaffected
Version Status Constraints
82f402fefa50f1675bf918bcd009981bd6b30ac8 affected < 0b2faa330184340d9418ad2c627c2ae881772e33
82f402fefa50f1675bf918bcd009981bd6b30ac8 affected < 665c94554ff0d5d88caae7f40c16c8e0a3369eda
82f402fefa50f1675bf918bcd009981bd6b30ac8 affected < 2882e1450fa4597811a951196e07553ea134eb31
82f402fefa50f1675bf918bcd009981bd6b30ac8 affected < 2b59484ac1e64dd78dbe8c6140891c6308085a75
82f402fefa50f1675bf918bcd009981bd6b30ac8 affected < 081cf37e8a0e00cd91d6df53172c9d928790a798
82f402fefa50f1675bf918bcd009981bd6b30ac8 affected < 5a1c5ff3a49ba93a1fd0b70537e7a0164071760d
Linux Linux affected
Version Status Constraints
4.13 affected —
0 unaffected < 4.13
6.1.188 unaffected ≤ 6.1.*
6.6.157 unaffected ≤ 6.6.*
6.12.110 unaffected ≤ 6.12.*
6.18.52 unaffected ≤ 6.18.*
7.2.6 unaffected ≤ 7.2.*
7.3-rc1 unaffected ≤ *

No data.

No data.

No data.

Project Subscriptions

Vendors Products
Linux Subscribe
Linux Kernel Subscribe
Advisories

No advisories yet.

Fixes

Solution

No solution given by the vendor.

Workaround

No workaround given by the vendor.

References
Link Providers
https://git.kernel.org/stable/c/081cf37e8a0e00cd91d6df53172c9d928790a798 cve-icon cve-icon
https://git.kernel.org/stable/c/0b2faa330184340d9418ad2c627c2ae881772e33 cve-icon cve-icon
https://git.kernel.org/stable/c/2882e1450fa4597811a951196e07553ea134eb31 cve-icon cve-icon
https://git.kernel.org/stable/c/2b59484ac1e64dd78dbe8c6140891c6308085a75 cve-icon cve-icon
https://git.kernel.org/stable/c/5a1c5ff3a49ba93a1fd0b70537e7a0164071760d cve-icon cve-icon
https://git.kernel.org/stable/c/665c94554ff0d5d88caae7f40c16c8e0a3369eda cve-icon cve-icon
History

Thu, 17 Sep 2026 16:30:00 +0000

Type Values Removed Values Added
Description In the Linux kernel, the following vulnerability has been resolved: null_blk: free global tag_set on init error path If shared_tags is enabled, null_setup_tagset() allocates the global tag_set via null_init_global_tag_set(). If device creation later fails, err_dev destroys the default devices and calls unregister_blkdev(), but never frees the global tag_set. Since module init failed, null_exit() is never invoked, so the global tag_set's tags and maps are permanently leaked. Free the global tag_set in err_dev, matching null_exit() which does if (tag_set.ops) blk_mq_free_tag_set(&tag_set).
Title null_blk: free global tag_set on init error path
First Time appeared Linux
Linux linux Kernel
CPEs cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Vendors & Products Linux
Linux linux Kernel
References

Projects

Sign in to view the affected projects.

cve-icon MITRE

Status: PUBLISHED

Assigner: Linux

Published:

Updated: 2026-09-17T16:07:10.349Z

Reserved: 2026-09-11T19:38:34.791Z

Link: CVE-2026-90188

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-09-17T17:17:13.397

Modified: 2026-09-17T17:17:13.397

Link: CVE-2026-90188

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

No data.

Weaknesses

No weakness.