In the Linux kernel, the following vulnerability has been resolved: null_blk: serialize configfs attribute stores with the lock The NULLB_DEVICE_ATTR _store takes no lock: apply_fn attributes (submit_queues, poll_queues) get dev->NAME written again after apply_fn returns, outside its lock; APPLY=NULL attributes are entirely lockless. configfs only serializes stores per-open-file, so concurrent stores on separate fds race. For apply_fn attributes, once one store's apply_fn has reconfigured the hardware, a second (losing) store can still overwrite dev->NAME afterwards. This leaves dev->submit_queues out of sync with the live queue count, which is later caught by the WARN_ON_ONCE() in null_map_queues(). For !apply_fn attributes, power_store()'s null_add_dev() validates and builds the device under "lock" but only sets CONFIGURED afterwards. A store slipping in during this window can change a field mid-setup -- for example, zone_nr_conv can be pushed above nr_zones after it has already been clamped, leading to an out-of-bounds dev->zones[] access. Take "lock" in the macro around the apply_fn call, the CONFIGURED test and the field write, and move it out of nullb_apply_submit_queues()/ nullb_apply_poll_queues() so both paths are covered once. This serializes stores with power_store's setup and with each other.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - null_blk: serialize configfs attribute stores with the lock The NULLB_DEVICE_ATTR _store takes no lock:
    apply_fn attributes (submit_queues, poll_queues) get dev->NAME written again after apply_fn returns,     outside its lock; APPLY=NULL attributes are entirely lockless. configfs only serializes stores per-open-     file, so concurrent stores on separate fds race. For apply_fn attributes, once one store's apply_fn has     reconfigured the hardware, a second (losing) store can still overwrite dev->NAME afterwards. This leaves     dev->submit_queues out of sync with the live queue count, which is later caught by the WARN_ON_ONCE() in     null_map_queues(). For !apply_fn attributes, power_store()'s null_add_dev() validates and builds the     device under lock but only sets CONFIGURED afterwards. A store slipping in during this window can change     a field mid-setup -- for example, zone_nr_conv can be pushed above nr_zones after it has already been     clamped, leading to an out-of-bounds dev->zones[] access. Take lock in the macro around the apply_fn     call, the CONFIGURED test and the field write, and move it out of nullb_apply_submit_queues()/     nullb_apply_poll_queues() so both paths are covered once. This serializes stores with power_store's setup     and with each other. (CVE-2026-90185)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
365279	Amazon Linux 2023 : bpftool6.12, kernel6.12, kernel6.12-devel (ALAS2023-2026-3196)	Nessus	Amazon Linux Local Security Checks	Local	medium
365220	Amazon Linux 2023 : bpftool, kernel, kernel-devel (ALAS2023-2026-3197)	Nessus	Amazon Linux Local Security Checks	Local	medium
364137	Oracle Linux 10 / 9 : Unbreakable Enterprise kernel (ELSA-2026-500374)	Nessus	Oracle Linux Local Security Checks	Local	high
362907	Debian dla-4817 : ata-modules-6.12.107+deb12-armmp-di - security update	Nessus	Debian Local Security Checks	Local	high
351155	Debian dsa-6528 : ata-modules-6.12.111+deb13-armmp-di - security update	Nessus	Debian Local Security Checks	Local	high
347704	Linux Distros Unpatched Vulnerability : CVE-2026-90185	Nessus	Misc.	Local	medium

Detections

Analytics

CVE-2026-90185

medium

Tenable Plugins

medium

medium

high

high

high

medium