CVE-2026-90206: Software Security Vulnerability Vulnerability

UNKNOWN
Advisory Identifier: GHSA-6cwp-gq4q-qccv
Share
Published
Advisory Summary

CVE-2026-90206 is a security vulnerability vulnerability (General Security Weakness) affecting Software libraries in the Maven ecosystem. Remediation is available in the latest vendor maintenance releases.

CVE-2026-90206 at a Glance

CVE Identifier CVE-2026-90206
GHSA Identifier GHSA-6cwp-gq4q-qccv
Severity N/A
CVSS v3.1 Base Score N/A
CWE Classification General Security Weakness
Affected Product Software
Package Ecosystem Maven
Published Date
Last Updated

How to Fix CVE-2026-90206

To remediate this vulnerability, upgrade all affected Software dependencies to a patched release. Both direct and transitive dependencies should be checked, as frameworks or security libraries may pull in vulnerable versions transitively.

Verify Direct and Transitive Dependencies

Run the following command in your project directory to verify that all resolved dependencies use the patched release: 

mvn dependency:tree

How to Check if You Are Affected

To determine whether your Java application is affected by CVE-2026-90206, inspect your build dependencies using the Maven Dependency Plugin:

mvn dependency:tree

Analyze the terminal output to locate any version of Software in your dependency tree. If any resolved version matches the vulnerable ranges listed in the table below (for example, versions earlier than the patched release), your application is affected.

Note: The mvn dependency:tree command inspects the resolved dependency graph declared in your project's POM files; it does not perform automated security scanning or inspect runtime dynamic classpaths. Always verify runtime container classpaths and shaded JARs.

Technical Details

Vulnerability Mechanism & Technical Analysis

This vulnerability is classified under General Security Weakness. In Software, software state validation or input boundaries are circumvented during processing. Review the official source advisory statement below for specific affected components, classes, and reproduction details.

Source Advisory Statement

In the Linux kernel, the following vulnerability has been resolved: nvmet: fix max_qid race between configfs and controller allocation The function nvmet_subsys_attr_qid_max_store() can race against nvmet_alloc_ctrl() when a subsystem's max_qid limit is modified. Suppose max_qid is currently 64. If nvmet_alloc_ctrl() executes: ctrl->sqs = kzalloc_objs(struct nvmet_sq *, subsys->max_qid + 1); and at this exact point, a userspace process changes max_qid to 128, nvmet_subsys_attr_qid_max_store() will set the new max_qid value. It attempts to delete active controllers to force a reconnect, but the new controller won't be deleted because it hasn't been added to the subsys->ctrls list yet. nvmet_alloc_ctrl() then proceeds and adds the new controller to the subsys->ctrls list. Later, when nvmet_install_queue() is called, it will see max_qid set to 128, but the memory allocated for sqs is only sized for 64 entries. This results in a KASAN out-of-bounds warning and potential memory corruptions. Fix this by protecting the queue allocations and list insertion in nvmet_alloc_ctrl() with down_read(&nvmet_config_sem). Because nvmet_subsys_attr_qid_max_store() acquires down_write(&nvmet_config_sem) to modify the attribute, this safely prevents the configfs writer from modifying max_qid during controller creation. Copy the max_qid from the subsystem to the controller's structure during the allocation; ctrl->max_qid never changes as long as the controller remains in LIVE state, so this will prevent similar race conditions.

References

NVD — CVE-2026-90206 NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-90206
git.kernel.org/stable/c/2c23fc9178... WEB
https://git.kernel.org/stable/c/2c23fc91789dfd9db746edb3ae9b90d65fabd410
git.kernel.org/stable/c/6e6f8e3bfc... WEB
https://git.kernel.org/stable/c/6e6f8e3bfc66dff1833a48ecfd857268cff3be84
git.kernel.org/stable/c/f1a8846e06... WEB
https://git.kernel.org/stable/c/f1a8846e06388113dfdbb89dee005083fa9afdf9

Frequently Asked Questions

What is CVE-2026-90206?
CVE-2026-90206 is a security vulnerability in Software classified as a security vulnerability vulnerability under General Security Weakness.
Which Software versions are affected?
Affected versions include releases prior to current release patches.
What version fixes CVE-2026-90206?
Upgrading to current release patches (or the latest patched release for your respective branch) resolves the vulnerability.
What CWE is associated with CVE-2026-90206?
CVE-2026-90206 is classified under General Security Weakness.
How can I check Maven dependencies for CVE-2026-90206?
Run the dependency tree command: 'mvn dependency:tree'. This command lists direct and transitive dependencies in your build configuration so you can verify if a vulnerable version is resolved.
Machine-readable OSV JSON OSV v1.5 Schema
Normalized schema output
View Raw JSON 
{
  "schema_version" : "1.4.0",
  "id" : "GHSA-6cwp-gq4q-qccv",
  "modified" : "2026-10-15T12:30:49Z",
  "published" : "2026-09-17T18:31:55Z",
  "aliases" : [ "CVE-2026-90206" ],
  "details" : "In the Linux kernel, the following vulnerability has been resolved:\n\nnvmet: fix max_qid race between configfs and controller allocation\n\nThe function nvmet_subsys_attr_qid_max_store() can race against\nnvmet_alloc_ctrl() when a subsystem's max_qid limit is modified.\n\nSuppose max_qid is currently 64. If nvmet_alloc_ctrl() executes:\nctrl->sqs = kzalloc_objs(struct nvmet_sq *, subsys->max_qid + 1);\nand at this exact point, a userspace process changes max_qid to 128,\nnvmet_subsys_attr_qid_max_store() will set the new max_qid value. It\nattempts to delete active controllers to force a reconnect, but the\nnew controller won't be deleted because it hasn't been added to the\nsubsys->ctrls list yet.\n\nnvmet_alloc_ctrl() then proceeds and adds the new controller to the\nsubsys->ctrls list. Later, when nvmet_install_queue() is called, it\nwill see max_qid set to 128, but the memory allocated for sqs is only\nsized for 64 entries. This results in a KASAN out-of-bounds warning\nand potential memory corruptions.\n\nFix this by protecting the queue allocations and list insertion in\nnvmet_alloc_ctrl() with down_read(&nvmet_config_sem). Because\nnvmet_subsys_attr_qid_max_store() acquires down_write(&nvmet_config_sem)\nto modify the attribute, this safely prevents the configfs writer from\nmodifying max_qid during controller creation.\n\nCopy the max_qid from the subsystem to the controller's structure\nduring the allocation; ctrl->max_qid never changes as long as the\ncontroller remains in LIVE state, so this will prevent similar race\nconditions.",
  "severity" : [ ],
  "affected" : [ ],
  "references" : [ {
    "type" : "ADVISORY",
    "url" : "https://nvd.nist.gov/vuln/detail/CVE-2026-90206"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/2c23fc91789dfd9db746edb3ae9b90d65fabd410"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/6e6f8e3bfc66dff1833a48ecfd857268cff3be84"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/f1a8846e06388113dfdbb89dee005083fa9afdf9"
  } ],
  "database_specific" : {
    "cwe_ids" : [ ],
    "severity" : null,
    "github_reviewed" : false,
    "github_reviewed_at" : null,
    "nvd_published_at" : "2026-09-17T17:17:15Z"
  }
}