CVE-2026-90180 - Vulnerability Details

- block: mtip32xx: synchronize ioctls with device removal

Description

In the Linux kernel, the following vulnerability has been resolved:

block: mtip32xx: synchronize ioctls with device removal

The ioctl handlers only test REMOVE_PENDING before entering
mtip_hw_ioctl(). Removal can set that bit immediately afterwards and free
dd->port in mtip_hw_exit() while an ioctl still dereferences it. An already
open block device can reach the handlers while del_gendisk() is in
progress.

Serialize both native and compat ioctls with removal. Set REMOVE_PENDING
before taking the mutex so new callers fail after an in-flight ioctl has
drained, and hold the mutex until the port has been torn down.

Published: 2026-09-17

Score: n/a

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

The vulnerability arises because the ioctl handlers for the mtip32xx block driver only check a pending‑removal flag before calling the core ioctl routine. When a device removal occurs, the flag can be set immediately afterwards and the device’s private data may be freed while an ioctl is still in progress, permitting the handler to dereference freed memory. This use‑after‑free can corrupt kernel memory and potentially allow an attacker with local access to execute arbitrary kernel code or cause a denial of service.

Affected Systems

All Linux kernel systems that load the mtip32xx block driver are affected. The vulnerability exists in kernel versions before the commit that synchronizes IOCTLs with device removal; specific affected versions are not listed.

Risk and Exploitability

The EPSS score of less than 1 % indicates the likelihood of exploitation is currently very low, and the vulnerability is not listed in the CISA KEV catalog. The CVSS score is not provided, but the use‑after‑free flaw suggests a high severity if exploited. Attackers would need local or privileged access to perform the vulnerable ioctl while the device is being removed, making this a local‑scope risk.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`88523a61558a040546bf7d8b079ae0755d8e7005`	affected	< 521afbd936ac256b7531470b0b9aa96abf9cd853
`88523a61558a040546bf7d8b079ae0755d8e7005`	affected	< 8283049aa5fcb4e84b2b2928b2888903bb8ee12e
`88523a61558a040546bf7d8b079ae0755d8e7005`	affected	< 8a7799597bd683b6bc251fe2edfa9fd1db568a3a
`88523a61558a040546bf7d8b079ae0755d8e7005`	affected	< 4609e0e0be709e974bec9b52c5022136d25e97d3
`88523a61558a040546bf7d8b079ae0755d8e7005`	affected	< b389dc35a55713ac24a145741e76196fea1663bc
`88523a61558a040546bf7d8b079ae0755d8e7005`	affected	< 68940f841d013192086a0f6d7cfbac2cd079e228

Linux

affected

Version	Status	Constraints
`3.3`	affected	—
`0`	unaffected	< 3.3
`6.1.188`	unaffected	≤ 6.1.*
`6.6.157`	unaffected	≤ 6.6.*
`6.12.110`	unaffected	≤ 6.12.*
`6.18.52`	unaffected	≤ 6.18.*
`7.2.6`	unaffected	≤ 7.2.*
`7.3-rc1`	unaffected	≤ *

No data.

Vendor Product Confidence Versions

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[88523a61558a040546bf7d8b079ae0755d8e7005,521afbd936ac256b7531470b0b9aa96abf9cd853)`	affected	code_commit	—
`[88523a61558a040546bf7d8b079ae0755d8e7005,8283049aa5fcb4e84b2b2928b2888903bb8ee12e)`	affected	code_commit	—
`[88523a61558a040546bf7d8b079ae0755d8e7005,8a7799597bd683b6bc251fe2edfa9fd1db568a3a)`	affected	code_commit	—
`[88523a61558a040546bf7d8b079ae0755d8e7005,4609e0e0be709e974bec9b52c5022136d25e97d3)`	affected	code_commit	—
`[88523a61558a040546bf7d8b079ae0755d8e7005,b389dc35a55713ac24a145741e76196fea1663bc)`	affected	code_commit	—
`[88523a61558a040546bf7d8b079ae0755d8e7005,68940f841d013192086a0f6d7cfbac2cd079e228)`	affected	code_commit	—

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`3.3`	affected	generic	—
`[0,3.3)`	unaffected	generic	—
`[6.1.188,6.2.0)`	unaffected	semver	—
`[6.6.157,6.7.0)`	unaffected	semver	—
`[6.12.110,6.13.0)`	unaffected	semver	—
`[6.18.52,6.19.0)`	unaffected	semver	—
`[7.2.6,7.3.0)`	unaffected	semver	—
`[7.3-rc1,*]`	unaffected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Update the kernel to a version that includes the 4609e0e0, 521afbd9 or later commits that synchronize IOCTLs with device removal.
Before removing an mtip32xx device, ensure no ioctl requests are in flight by pausing user operations and waiting for all in‑flight IOCTLS to complete.
If a patched kernel is not yet available, temporarily unload or blacklist the mtip32xx driver so the device cannot be accessed until the kernel is updated.

Generated by OpenCVE AI on September 20, 2026 at 02:14 UTC.

Tracking

Sign in to view the affected projects.

Advisories

Source	ID	Title
Debian DLA	DLA-4817-1	linux-6.12 security update
Debian DSA	DSA-6528-1	linux security update

No CVSS v4.0

No CVSS v3.1

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00215.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/4609e0e0be709e974bec9b52c5022136d25e97d3
https://git.kernel.org/stable/c/521afbd936ac256b7531470b0b9aa96abf9cd853
https://git.kernel.org/stable/c/68940f841d013192086a0f6d7cfbac2cd079e228
https://git.kernel.org/stable/c/8283049aa5fcb4e84b2b2928b2888903bb8ee12e
https://git.kernel.org/stable/c/8a7799597bd683b6bc251fe2edfa9fd1db568a3a
https://git.kernel.org/stable/c/b389dc35a55713ac24a145741e76196fea1663bc

History

Sun, 20 Sep 2026 02:30:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-416

Thu, 17 Sep 2026 16:30:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: block: mtip32xx: synchronize ioctls with device removal The ioctl handlers only test REMOVE_PENDING before entering mtip_hw_ioctl(). Removal can set that bit immediately afterwards and free dd->port in mtip_hw_exit() while an ioctl still dereferences it. An already open block device can reach the handlers while del_gendisk() is in progress. Serialize both native and compat ioctls with removal. Set REMOVE_PENDING before taking the mutex so new callers fail after an in-flight ioctl has drained, and hold the mutex until the port has been torn down.
Title		block: mtip32xx: synchronize ioctls with device removal
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/4609e0e0be709e974bec9b52c5022136d25e97d3 https://git.kernel.org/stable/c/521afbd936ac256b7531470b0b9aa96abf9cd853 https://git.kernel.org/stable/c/68940f841d013192086a0f6d7cfbac2cd079e228 https://git.kernel.org/stable/c/8283049aa5fcb4e84b2b2928b2888903bb8ee12e https://git.kernel.org/stable/c/8a7799597bd683b6bc251fe2edfa9fd1db568a3a https://git.kernel.org/stable/c/b389dc35a55713ac24a145741e76196fea1663bc

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-09-17T16:07:05.083Z

Updated: 2026-09-17T16:07:05.083Z

Reserved: 2026-09-11T19:38:34.791Z

Link: CVE-2026-90180

Vulnrichment

No data.

NVD

Status : Received

Published: 2026-09-17T17:17:12.123

Modified: 2026-09-17T17:17:12.123

Link: CVE-2026-90180

Redhat

No data.

OpenCVE Enrichment

Updated: 2026-09-20T02:15:17Z

Weaknesses

CWE-416
Use After Free

Impact

Affected Systems

Risk and Exploitability

Tracking

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object