CVE-2026-90182: Software Security Vulnerability Vulnerability

UNKNOWN
Advisory Identifier: GHSA-3p27-2gjm-jxc2
Share
Published
Advisory Summary

CVE-2026-90182 is a security vulnerability vulnerability (General Security Weakness) affecting Software libraries in the Maven ecosystem. Remediation is available in the latest vendor maintenance releases.

CVE-2026-90182 at a Glance

CVE Identifier CVE-2026-90182
GHSA Identifier GHSA-3p27-2gjm-jxc2
Severity N/A
CVSS v3.1 Base Score N/A
CWE Classification General Security Weakness
Affected Product Software
Package Ecosystem Maven
Published Date
Last Updated

How to Fix CVE-2026-90182

To remediate this vulnerability, upgrade all affected Software dependencies to a patched release. Both direct and transitive dependencies should be checked, as frameworks or security libraries may pull in vulnerable versions transitively.

Verify Direct and Transitive Dependencies

Run the following command in your project directory to verify that all resolved dependencies use the patched release: 

mvn dependency:tree

How to Check if You Are Affected

To determine whether your Java application is affected by CVE-2026-90182, inspect your build dependencies using the Maven Dependency Plugin:

mvn dependency:tree

Analyze the terminal output to locate any version of Software in your dependency tree. If any resolved version matches the vulnerable ranges listed in the table below (for example, versions earlier than the patched release), your application is affected.

Note: The mvn dependency:tree command inspects the resolved dependency graph declared in your project's POM files; it does not perform automated security scanning or inspect runtime dynamic classpaths. Always verify runtime container classpaths and shaded JARs.

Technical Details

Vulnerability Mechanism & Technical Analysis

This vulnerability is classified under General Security Weakness. In Software, software state validation or input boundaries are circumvented during processing. Review the official source advisory statement below for specific affected components, classes, and reproduction details.

Source Advisory Statement

In the Linux kernel, the following vulnerability has been resolved: blk-iocost: clear delay state when freeing policy data iocg_kick_delay() turns sufficiently large debt into an explicit block-cgroup delay with blkcg_set_delay(), setting blkg->use_delay to -1 and incrementing blkcg->congestion_count. Clearing it again depends on iocg_kick_delay() running from the period timer, the waitq timer or the issue path. ioc_pd_free() removes the iocg from active_iocgs and cancels its waitq timer, and no further bios can arrive, so once it has run nothing is left which can reduce the debt and clear the delay. The blkcg stays marked congested for the rest of its life. blk_cgroup_congested() then returns true for every task in that cgroup and its descendants: page_cache_sync_ra() cuts readahead to a single page, page_cache_async_ra() skips it altogether, and __folio_throttle_swaprate() takes swap_avail_lock and schedules a throttle on anonymous folio allocation. Clear it explicitly, after the list removal and the synchronous hrtimer_cancel() so that neither timer processing nor an I/O path can re-arm it. The free callback can also see policy data which was never attached to a blkg, hence the pd->blkg check.

References

NVD — CVE-2026-90182 NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-90182
git.kernel.org/stable/c/97cb95d214... WEB
https://git.kernel.org/stable/c/97cb95d2148835ae86ff916b145aef332d40439d
git.kernel.org/stable/c/b399a88eb8... WEB
https://git.kernel.org/stable/c/b399a88eb8b16c5a1a3645fd49ff507fb82b363c
git.kernel.org/stable/c/b9c16db833... WEB
https://git.kernel.org/stable/c/b9c16db833e3ff15d923282f94dddf0e10fab8c0

Frequently Asked Questions

What is CVE-2026-90182?
CVE-2026-90182 is a security vulnerability in Software classified as a security vulnerability vulnerability under General Security Weakness.
Which Software versions are affected?
Affected versions include releases prior to current release patches.
What version fixes CVE-2026-90182?
Upgrading to current release patches (or the latest patched release for your respective branch) resolves the vulnerability.
What CWE is associated with CVE-2026-90182?
CVE-2026-90182 is classified under General Security Weakness.
How can I check Maven dependencies for CVE-2026-90182?
Run the dependency tree command: 'mvn dependency:tree'. This command lists direct and transitive dependencies in your build configuration so you can verify if a vulnerable version is resolved.
Machine-readable OSV JSON OSV v1.5 Schema
Normalized schema output
View Raw JSON 
{
  "schema_version" : "1.4.0",
  "id" : "GHSA-3p27-2gjm-jxc2",
  "modified" : "2026-10-15T12:30:49Z",
  "published" : "2026-09-17T18:31:54Z",
  "aliases" : [ "CVE-2026-90182" ],
  "details" : "In the Linux kernel, the following vulnerability has been resolved:\n\nblk-iocost: clear delay state when freeing policy data\n\niocg_kick_delay() turns sufficiently large debt into an explicit\nblock-cgroup delay with blkcg_set_delay(), setting blkg->use_delay to\n-1 and incrementing blkcg->congestion_count.  Clearing it again depends\non iocg_kick_delay() running from the period timer, the waitq timer or\nthe issue path.\n\nioc_pd_free() removes the iocg from active_iocgs and cancels its waitq\ntimer, and no further bios can arrive, so once it has run nothing is\nleft which can reduce the debt and clear the delay.  The blkcg stays\nmarked congested for the rest of its life.\n\nblk_cgroup_congested() then returns true for every task in that cgroup\nand its descendants: page_cache_sync_ra() cuts readahead to a single\npage, page_cache_async_ra() skips it altogether, and\n__folio_throttle_swaprate() takes swap_avail_lock and schedules a\nthrottle on anonymous folio allocation.\n\nClear it explicitly, after the list removal and the synchronous\nhrtimer_cancel() so that neither timer processing nor an I/O path can\nre-arm it.  The free callback can also see policy data which was never\nattached to a blkg, hence the pd->blkg check.",
  "severity" : [ ],
  "affected" : [ ],
  "references" : [ {
    "type" : "ADVISORY",
    "url" : "https://nvd.nist.gov/vuln/detail/CVE-2026-90182"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/97cb95d2148835ae86ff916b145aef332d40439d"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/b399a88eb8b16c5a1a3645fd49ff507fb82b363c"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/b9c16db833e3ff15d923282f94dddf0e10fab8c0"
  } ],
  "database_specific" : {
    "cwe_ids" : [ ],
    "severity" : null,
    "github_reviewed" : false,
    "github_reviewed_at" : null,
    "nvd_published_at" : "2026-09-17T17:17:12Z"
  }
}