CVE-2026-90206 Linux CVE debrief

Who should care

Linux kernel developers, administrators, and users who need to ensure the security and integrity of their Linux-based systems. They should verify affected versions, review and apply patches, and monitor for potential issues. Additionally, operators, platform managers, vulnerability management teams, and security teams should be aware of the potential impact and take necessary actions to mitigate the vulnerability.

Why it matters

A race condition vulnerability in the Linux kernel's nvmet subsystem can lead to a KASAN out-of-bounds warning and potential memory corruption, requiring verification of affected versions, review and application of patches, and monitoring for potential issues.

• Potential memory corruption and KASAN out-of-bounds warnings.
• Need to verify affected versions and assess exposure.
• Requires review and application of Linux kernel patches.

Technical summary

The Linux kernel's nvmet subsystem is vulnerable to a race condition when the max_qid limit is modified via configfs while a controller is being allocated. This can lead to a KASAN out-of-bounds warning and potential memory corruption. The issue is resolved in Linux kernel versions 6.1 and later. The vulnerability arises from a mismatch between the allocated memory for the controller's sqs and the updated max_qid value. To address this issue, developers should review and apply Linux kernel patches, verify affected versions, and assess exposure.

Defensive priority

Medium

Recommended defensive actions

• Review and apply the Linux kernel patches referenced in the CVE record and source item.
• Verify the affected versions of the Linux kernel and assess exposure.
• Monitor for potential memory corruption and KASAN out-of-bounds warnings.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.

Evidence notes

The CVE record and source item provide details on the vulnerability, including its description, affected versions, and references to the Linux kernel patches. However, the corpus does not establish versions, exploitation, impact, or remediation beyond the provided official sources.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.