CVE-2026-90188

null_blk: free global tag_set on init error path

State: Published
Severity: Not scored
Published: Sep 17, 2026
Updated: Oct 19, 2026
Reserved: Sep 11, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

null_blk: free global tag_set on init error path

If shared_tags is enabled, null_setup_tagset() allocates the global tag_set via null_init_global_tag_set(). If device creation later fails, err_dev destroys the default devices and calls unregister_blkdev(), but never frees the global tag_set. Since module init failed, null_exit() is never invoked, so the global tag_set's tags and maps are permanently leaked.

Free the global tag_set in err_dev, matching null_exit() which does if (tag_set.ops) blk_mq_free_tag_set(&tag_set).

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	82f402fefa50f1675bf918bcd009981bd6b30ac8 to before 0b2faa330184340d9418ad2c627c2ae881772e33Affected 82f402fefa50f1675bf918bcd009981bd6b30ac8 to before 665c94554ff0d5d88caae7f40c16c8e0a3369edaAffected 82f402fefa50f1675bf918bcd009981bd6b30ac8 to before 2882e1450fa4597811a951196e07553ea134eb31Affected 82f402fefa50f1675bf918bcd009981bd6b30ac8 to before 2b59484ac1e64dd78dbe8c6140891c6308085a75Affected 82f402fefa50f1675bf918bcd009981bd6b30ac8 to before 081cf37e8a0e00cd91d6df53172c9d928790a798Affected 82f402fefa50f1675bf918bcd009981bd6b30ac8 to before 5a1c5ff3a49ba93a1fd0b70537e7a0164071760dAffected
LinuxLinux	4.13Affected before 4.13Not affected 6.1.188 through 6.1.Not affected 6.6.157 through 6.6.Not affected 6.12.110 through 6.12.Not affected 6.18.52 through 6.18.Not affected 7.2.6 through 7.2.*Not affected 7.3 and laterNot affected

Product

Versions

LinuxLinux

82f402fefa50f1675bf918bcd009981bd6b30ac8 to before 0b2faa330184340d9418ad2c627c2ae881772e33Affected
82f402fefa50f1675bf918bcd009981bd6b30ac8 to before 665c94554ff0d5d88caae7f40c16c8e0a3369edaAffected
82f402fefa50f1675bf918bcd009981bd6b30ac8 to before 2882e1450fa4597811a951196e07553ea134eb31Affected
82f402fefa50f1675bf918bcd009981bd6b30ac8 to before 2b59484ac1e64dd78dbe8c6140891c6308085a75Affected
82f402fefa50f1675bf918bcd009981bd6b30ac8 to before 081cf37e8a0e00cd91d6df53172c9d928790a798Affected
82f402fefa50f1675bf918bcd009981bd6b30ac8 to before 5a1c5ff3a49ba93a1fd0b70537e7a0164071760dAffected

LinuxLinux

4.13Affected
before 4.13Not affected
6.1.188 through 6.1.*Not affected
6.6.157 through 6.6.*Not affected
6.12.110 through 6.12.*Not affected
6.18.52 through 6.18.*Not affected
7.2.6 through 7.2.*Not affected
7.3 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.