Executive brief
The Linux kernel's ublk (user block device) subsystem contains a flaw in memory cleanup code that can cause the system to hang indefinitely during device teardown. When a temporary allocation fails, the cleanup loop retries the same operation without making progress, potentially freezing device removal operations that use shared memory zero-copy buffers.
Technical details
The vulnerability exists in the __ublk_shmem_remove_ranges() function, which removes maple tree ranges by temporarily storing them in an xarray under a maple tree lock before unpinning pages. When xa_store() fails due to GFP_ATOMIC allocation exhaustion, the range remains in the tree and the function returns false, causing the outer loop to retry the same range indefinitely without progress. The root cause is a dependency on atomic memory allocation within a teardown path that has no forward progress guarantee. The fix removes the xarray allocation by collecting range pairs in a fixed-size stack array and erasing ranges from the maple tree before releasing the lock, ensuring each iteration makes progress regardless of allocation failures.
Affected products
- Linux Linux kernel prior to fix for CVE-2026-90181
Timeline
- 2026-09-17: disclosed