CVE-2026-90180

Description

In the Linux kernel, the following vulnerability has been resolved: block: mtip32xx: synchronize ioctls with device removal The ioctl handlers only test REMOVE_PENDING before entering mtip_hw_ioctl(). Removal can set that bit immediately afterwards and free dd->port in mtip_hw_exit() while an ioctl still dereferences it. An already open block device can reach the handlers while del_gendisk() is in progress. Serialize both native and compat ioctls with removal. Set REMOVE_PENDING before taking the mutex so new callers fail after an in-flight ioctl has drained, and hold the mutex until the port has been torn down.

Is your site exposed to CVE-2026-90180?

Run a free security scan — no signup, results in seconds.

EPSS — Exploit Prediction

0.0021

Probability of exploitation

0.10%

Percentile rank

EPSS estimates the probability that this vulnerability will be exploited in the wild within the next 30 days. A higher score means more likely to be exploited.

References

Other References

https://git.kernel.org/stable/c/4609e0e0be709e974bec9b52c5022136d25e97d3 https://git.kernel.org/stable/c/521afbd936ac256b7531470b0b9aa96abf9cd853 https://git.kernel.org/stable/c/68940f841d013192086a0f6d7cfbac2cd079e228 https://git.kernel.org/stable/c/8283049aa5fcb4e84b2b2928b2888903bb8ee12e https://git.kernel.org/stable/c/8a7799597bd683b6bc251fe2edfa9fd1db568a3a https://git.kernel.org/stable/c/b389dc35a55713ac24a145741e76196fea1663bc

Frequently Asked Questions

What is CVE-2026-90180? +

In the Linux kernel, the following vulnerability has been resolved: block: mtip32xx: synchronize ioctls with device removal The ioctl handlers only test REMOVE_PENDING before entering mtip_hw_ioctl(). Removal can set that bit immediately afterwards and free dd->port in mtip_hw_exit() while an ioctl still dereferences it. An already open block device can reach the handlers while del_gendisk() is in progress. Serialize both native and compat ioctls with removal. Set REMOVE_PENDING before taking the mutex so new callers fail after an in-flight ioctl has drained, and hold the mutex until the port has been torn down.

How do I check if I'm vulnerable to CVE-2026-90180? +

You can use Secably's free Website Scanner to check your website for known vulnerabilities. For infrastructure scanning, use the Port Scanner to identify exposed services that may be affected. Check the vendor advisories linked above for specific patch and version information.