CVE-2026-90180

block: mtip32xx: synchronize ioctls with device removal

State: Published
Severity: Not scored
Published: Sep 17, 2026
Updated: Oct 19, 2026
Reserved: Sep 11, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

block: mtip32xx: synchronize ioctls with device removal

The ioctl handlers only test REMOVE_PENDING before entering mtip_hw_ioctl(). Removal can set that bit immediately afterwards and free dd->port in mtip_hw_exit() while an ioctl still dereferences it. An already open block device can reach the handlers while del_gendisk() is in progress.

Serialize both native and compat ioctls with removal. Set REMOVE_PENDING before taking the mutex so new callers fail after an in-flight ioctl has drained, and hold the mutex until the port has been torn down.

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	88523a61558a040546bf7d8b079ae0755d8e7005 to before 521afbd936ac256b7531470b0b9aa96abf9cd853Affected 88523a61558a040546bf7d8b079ae0755d8e7005 to before 8283049aa5fcb4e84b2b2928b2888903bb8ee12eAffected 88523a61558a040546bf7d8b079ae0755d8e7005 to before 8a7799597bd683b6bc251fe2edfa9fd1db568a3aAffected 88523a61558a040546bf7d8b079ae0755d8e7005 to before 4609e0e0be709e974bec9b52c5022136d25e97d3Affected 88523a61558a040546bf7d8b079ae0755d8e7005 to before b389dc35a55713ac24a145741e76196fea1663bcAffected 88523a61558a040546bf7d8b079ae0755d8e7005 to before 68940f841d013192086a0f6d7cfbac2cd079e228Affected
LinuxLinux	3.3Affected before 3.3Not affected 6.1.188 through 6.1.Not affected 6.6.157 through 6.6.Not affected 6.12.110 through 6.12.Not affected 6.18.52 through 6.18.Not affected 7.2.6 through 7.2.*Not affected 7.3 and laterNot affected

Product

Versions

LinuxLinux

88523a61558a040546bf7d8b079ae0755d8e7005 to before 521afbd936ac256b7531470b0b9aa96abf9cd853Affected
88523a61558a040546bf7d8b079ae0755d8e7005 to before 8283049aa5fcb4e84b2b2928b2888903bb8ee12eAffected
88523a61558a040546bf7d8b079ae0755d8e7005 to before 8a7799597bd683b6bc251fe2edfa9fd1db568a3aAffected
88523a61558a040546bf7d8b079ae0755d8e7005 to before 4609e0e0be709e974bec9b52c5022136d25e97d3Affected
88523a61558a040546bf7d8b079ae0755d8e7005 to before b389dc35a55713ac24a145741e76196fea1663bcAffected
88523a61558a040546bf7d8b079ae0755d8e7005 to before 68940f841d013192086a0f6d7cfbac2cd079e228Affected

LinuxLinux

3.3Affected
before 3.3Not affected
6.1.188 through 6.1.*Not affected
6.6.157 through 6.6.*Not affected
6.12.110 through 6.12.*Not affected
6.18.52 through 6.18.*Not affected
7.2.6 through 7.2.*Not affected
7.3 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.