From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 3C8874F96A4 for ; Thu, 17 Sep 2026 16:21:05 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1789662066; cv=none; b=U+hPXEGeStEs4cRKlHgmRwYqRklc838aVbsVz17DxwsMf8aE+uIt6Syg7unrOcWBBiW1p26URaGmDaDlhR2kJJ/iaky+36+f34sq1VNg61HE7Z86EEaWJkWC2RqRuGksmbR1K0HMLVLyYUzhaBzd4BC441RwD1M6FcB8Bw5wJXU= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1789662066; c=relaxed/simple; bh=Eg0Z0iolc7OMezgZCsCwoe5bNPYnbQoMhYBiNtobHfU=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=ps/k3P4hILINqW4JSuQsmhggGWA9Yqy3RxI1zV5mhMA7tc7CWN3iwV8a+bjsvR8GHPWjQEUodTUlP6eSL/ubo3pcgVPCQmwUfQgB44+liHBm72UaHH169rQE+I8nxEAPvvyvcWN65gPuYn4lgxB8yu4VrZmXQxW6M3V/XJtC+vs= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=zgm7uQ5A; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b="zgm7uQ5A" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 943201F000FF; Thu, 17 Sep 2026 16:21:04 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linuxfoundation.org; s=korg; t=1789662065; bh=EX05u7twWHFdkyREyn/5eJv4Pwk6ovEXJJBUYZMiUWs=; h=From:To:Cc:Subject:Date:Reply-To; b=zgm7uQ5AFUaGhBbBH1jHw265eURe3FOuVCzM7zKn0k/laxL+1MFsszm3W+sUGvaSE tTmAU2eXtuY1LYmrZpUdap4N1552pqtqcLSWhtaSHq6SrnxMgabOfq2hEmhotE7zSz kMhjfrByJfOAQtkupIvQckw8WAJ2pxZs6pVUEmyE= From: Greg Kroah-Hartman To: linux-cve-announce@vger.kernel.org Cc: Greg Kroah-Hartman Subject: CVE-2026-90229: nvme-apple: Destroy the admin queue on removal Date: Thu, 17 Sep 2026 17:10:59 +0100 Message-ID: <2026091740-CVE-2026-90229-b00a@gregkh> X-Mailer: git-send-email 2.55.0 Reply-To: , Precedence: bulk X-Mailing-List: linux-cve-announce@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 X-Developer-Signature: v=1; a=openpgp-sha256; l=6813; i=gregkh@linuxfoundation.org; h=from:subject:message-id; bh=1wglkH5HPJWh+itEjQ7UWosjEJZpBJFQFH/NAsaUBRY=; b=owGbwMvMwCRo6H6F97bub03G02pJDFlrBDpis6IVXqzv1aw/1HlFcO+Odylq6+cXeNSE3rKLP RnRzsrZEcvCIMjEICumyPJlG8/R/RWHFL0MbU/DzGFlAhnCwMUpABM5XMswvySuWuNny/1tP6f6 p5723mO4tM6Dn2HB9E/vQ2684Dx7J6uu4L7A8oWp26y3AwA= X-Developer-Key: i=gregkh@linuxfoundation.org; a=openpgp; fpr=F4B60CC5BF78C2214A313DCB3147D40DDB2DFB29 Content-Transfer-Encoding: 8bit From: Greg Kroah-Hartman Description =========== In the Linux kernel, the following vulnerability has been resolved: nvme-apple: Destroy the admin queue on removal The admin queue is allocated with blk_mq_alloc_queue() but never destroyed. nvme_free_ctrl() only drops the last reference and blk_mq_exit_queue() and blk_sync_queue() never run: the hctx is never moved to q->unused_hctx_list and the timeout timer and work stay armed on a queue that is about to be freed which will eventually oops inside blk_mq_timeout_work(). This can only be triggered when the controller fails to come up and is then immediately torn down again which is why no one ever ran into this before. Let's just copy what the pcie driver does: unquiesce and destroy the admin queue before nvme_uninit_ctrl(). With this the following WARN followed by a panic no longer happens: WARNING: block/blk-mq.c:4390 at blk_mq_release+0x194/0x238, CPU#4: kworker/u34:4/119 CPU: 4 UID: 0 PID: 119 Comm: kworker/u34:4 Not tainted 7.2.0-rc1-dirty #248 PREEMPT Hardware name: Apple Mac mini (M1, 2020) (DT) Workqueue: nvme-wq apple_nvme_remove_dead_ctrl_work pstate: 61400005 (nZCv daif +PAN -UAO -TCO +DIT -SSBS BTYPE=--) pc : blk_mq_release+0x194/0x238 lr : blk_mq_release+0x58/0x238 sp : ffffc000833a3b50 x29: ffffc000833a3b50 x28: ffff80001d0450f8 x27: ffff800020c95200 x26: 0000000000000088 x25: 0000000000000000 x24: ffff800020f36805 x23: 0000000000000000 x22: ffffc00081a86878 x21: ffff800020be9c60 x20: 0000000000000000 x19: ffff800022501698 x18: 000000000000000a x17: 7365757165722066 x16: 666f7265776f7020 x15: 0000000000000000 x14: 0000000000000028 x13: 0000000000004def x12: 0000000000000003 x11: 0000000000000000 x10: 0000000000000000 x9 : ffffc000805b4fc8 x8 : ffffc00081915820 x7 : ffffc00081c4f3c8 x6 : 0000000000000001 x5 : 0000000000000004 x4 : ffff800022498d80 x3 : ffffc000833a3b14 x2 : 0000000000000000 x1 : 0000000000000000 x0 : ffff800022501698 Call trace: blk_mq_release+0x194/0x238 (P) blk_put_queue+0x8c/0xf0 nvme_free_ctrl+0x4c/0x260 device_release+0x44/0x128 kobject_put+0xa0/0x120 put_device+0x1c/0x40 nvme_uninit_ctrl+0x48/0x60 apple_nvme_remove+0x54/0xb0 platform_remove+0x28/0x40 device_remove+0x54/0x98 device_release_driver_internal+ device_release_driver+0x20/0x38 apple_nvme_remove_dead_ctrl_wor process_one_work+0x1f4/0x770 worker_thread+0x1b8/0x360 kthread+0x140/0x160 ret_from_fork+0x10/0x20 irq event stamp: 448 hardirqs last enabled at (447):in_unlock_irqrestore+0x74/0x80 hardirqs last disabled at (448): [] el1_brk64+0x20/0x60 softirqs last enabled at (0): [ess+0xb28/0x2698 softirqs last disabled at (0): [<0000000000000000>] 0x0 ---[ end trace 0000000000000000 Unable to handle kernel NULL pointer dereference at virtual address 0000000000000000 Mem abort info: ESR = 0x0000000096000005 EC = 0x25: DABT (current EL), SET = 0, FnV = 0 EA = 0, S1PTW = 0 FSC = 0x05: level 1 translation fault Data abort info: ISV = 0, ISS = 0x00000005, ISS2 = 0x00000000 CM = 0, WnR = 0, TnD = 0, TagA GCS = 0, Overlay = 0, DirtyBit = 0, Xs = 0 [0000000000000000] user address Internal error: Oops: 0000000096000005 [#1] SMP CPU: 7 UID: 0 PID: 54 Comm: kwor 7.2.0-rc1-dirty #248PREEMPT Tainted: [W]=WARN Hardware name: Apple Mac mini (M1, 2020) (DT) Workqueue: kblockd blk_mq_timeou pstate: 01400005 (nzcv daif +PAN -UAO -TCO +DIT -SSBS BTYPE=--) pc : percpu_ref_tryget_many.cons lr : percpu_ref_tryget_many.constprop.0+0xc0/0x168 sp : ffffc000829cbce0 x29: ffffc000829cbce0 x28: ffff800020be9f48 x27: ffff800013e503c0 x26: 0000000000000108 x25: 000009c05 x23: 0000000000000000 x22: ffffc000819f5000 x21: ffff800020be9f48 x20: ffff8001deda4808 x19: ffff8000a x17: 00000000580e1fac x16: ffffc00082bbbb7c x15: 0000000000000000 x14: 0000000000000028 x13: 000000001 x11: 0000000000000000 x10: 0000000000000000 x9 : ffffc000829cbc20 x8 : ffffc00081915820 x7 : ffffc0001 x5 : ffff80001ca77d08 x4 : 0000000000000000 x3 : ffff80001ca77cb8 x2 : 0000000000000000 x1 : 000000007 Call trace: percpu_ref_tryget_many.constpro blk_mq_timeout_work+0x48/0x298 process_one_work+0x1f4/0x770 worker_thread+0x1b8/0x360 kthread+0x140/0x160 ret_from_fork+0x10/0x20 Code: 91282000 97ed44b2 17ffffd2 ---[ end trace 0000000000000000 ]--- The Linux kernel CVE team has assigned CVE-2026-90229 to this issue. Affected and fixed versions =========================== Issue introduced in 5.19 with commit 5bd2927aceba181b84286e00aa2f56e117e699c3 and fixed in 6.6.157 with commit 5f6f4777b7a8676251139dbfbcdec3cb578f0e40 Issue introduced in 5.19 with commit 5bd2927aceba181b84286e00aa2f56e117e699c3 and fixed in 6.12.110 with commit bf51e306e3dcffd1a63ef09a7a39d28f3578dd2d Issue introduced in 5.19 with commit 5bd2927aceba181b84286e00aa2f56e117e699c3 and fixed in 6.18.52 with commit 215d1682f0bae495f3f9cf692b358116b7a18602 Issue introduced in 5.19 with commit 5bd2927aceba181b84286e00aa2f56e117e699c3 and fixed in 7.2.6 with commit c11685ee4eedc70f738b117a4a8c0fbe84cd79b3 Issue introduced in 5.19 with commit 5bd2927aceba181b84286e00aa2f56e117e699c3 and fixed in 7.3-rc1 with commit 87d5b9864c8118d26f54de4b66d2bddf2c659272 Please see https://www.kernel.org for a full list of currently supported kernel versions by the kernel community. Unaffected versions might change over time as fixes are backported to older supported kernel versions. The official CVE entry at https://cve.org/CVERecord/?id=CVE-2026-90229 will be updated if fixes are backported, please check that for the most up to date information about this issue. Affected files ============== The file(s) affected by this issue are: drivers/nvme/host/apple.c Mitigation ========== The Linux kernel CVE team recommends that you update to the latest stable kernel version for this, and many other bugfixes. Individual changes are never tested alone, but rather are part of a larger kernel release. Cherry-picking individual commits is not recommended or supported by the Linux kernel community at all. If however, updating to the latest release is impossible, the individual changes to resolve this issue can be found at these commits: https://git.kernel.org/stable/c/5f6f4777b7a8676251139dbfbcdec3cb578f0e40 https://git.kernel.org/stable/c/bf51e306e3dcffd1a63ef09a7a39d28f3578dd2d https://git.kernel.org/stable/c/215d1682f0bae495f3f9cf692b358116b7a18602 https://git.kernel.org/stable/c/c11685ee4eedc70f738b117a4a8c0fbe84cd79b3 https://git.kernel.org/stable/c/87d5b9864c8118d26f54de4b66d2bddf2c659272