CVE-2026-90187 (GCVE-0-2026-90187)
Vulnerability from cvelistv5
Published
2026-09-17 16:07
Modified
2026-10-21 12:50
Severity ?
Summary
In the Linux kernel, the following vulnerability has been resolved: null_blk: free zones array on device power-off null_init_zoned_dev() allocates dev->zones when a zoned device is powered on, but null_del_dev() never frees it on power-off; dev->zones is only freed later in null_free_dev(), when the configfs directory is removed. If the device is powered off and then on again, null_init_zoned_dev() allocates a new array and overwrites the dev->zones pointer, leaking the previous allocation each power cycle. Free dev->zones in null_del_dev() via null_free_zoned_dev() to solve it. And calling null_free_zoned_dev() in null_free_dev() is no longer necessary because every caller already invokes null_del_dev() first: via nullb_group_drop_item() before nullb_device_release(), in the null_add_dev() error path of null_create_dev(), and in null_destroy_dev(). Remove the redundant call. And take &lock around zone_cond_store() in the two store wrappers to serialize dev->zones check-and-deref against its alloc/free, which already run under &lock. The reason there was no problem before is that only nullb_device_release() or null_exit() frees the dev->zones, which guarantees that subsequent users won't access the configfs interface.
References
Impacted products
Vendor Product Version
Linux Linux Version: ca4b2a011948fae4e4d31490107db4926385a983
Version: ca4b2a011948fae4e4d31490107db4926385a983
Version: ca4b2a011948fae4e4d31490107db4926385a983
Version: ca4b2a011948fae4e4d31490107db4926385a983
Version: ca4b2a011948fae4e4d31490107db4926385a983
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/block/null_blk/main.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "08a31a2cc3d1cea67ccd292d01511cd0a72d4656",
              "status": "affected",
              "version": "ca4b2a011948fae4e4d31490107db4926385a983",
              "versionType": "git"
            },
            {
              "lessThan": "056be41932c95aabdb3c2967d1ef4978f17a0225",
              "status": "affected",
              "version": "ca4b2a011948fae4e4d31490107db4926385a983",
              "versionType": "git"
            },
            {
              "lessThan": "b2437d37fcc31fce8a5da1cc1739e284814d2491",
              "status": "affected",
              "version": "ca4b2a011948fae4e4d31490107db4926385a983",
              "versionType": "git"
            },
            {
              "lessThan": "0a3afab87124171022fb3579502fa38ef5b311c9",
              "status": "affected",
              "version": "ca4b2a011948fae4e4d31490107db4926385a983",
              "versionType": "git"
            },
            {
              "lessThan": "2a6357a9b935a34f5508618fee8a7fffbf7722a8",
              "status": "affected",
              "version": "ca4b2a011948fae4e4d31490107db4926385a983",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/block/null_blk/main.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.19"
            },
            {
              "lessThan": "4.19",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.160",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.110",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.52",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.6",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.3",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.160",
                  "versionStartIncluding": "4.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.110",
                  "versionStartIncluding": "4.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.52",
                  "versionStartIncluding": "4.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2.6",
                  "versionStartIncluding": "4.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.3",
                  "versionStartIncluding": "4.19",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnull_blk: free zones array on device power-off\n\nnull_init_zoned_dev() allocates dev-\u003ezones when a zoned device is powered\non, but null_del_dev() never frees it on power-off; dev-\u003ezones is only\nfreed later in null_free_dev(), when the configfs directory is removed. If\nthe device is powered off and then on again, null_init_zoned_dev()\nallocates a new array and overwrites the dev-\u003ezones pointer, leaking the\nprevious allocation each power cycle.\n\nFree dev-\u003ezones in null_del_dev() via null_free_zoned_dev() to solve it.\nAnd calling null_free_zoned_dev() in null_free_dev() is no longer necessary\nbecause every caller already invokes null_del_dev() first: via\nnullb_group_drop_item() before nullb_device_release(), in the\nnull_add_dev() error path of null_create_dev(), and in null_destroy_dev().\nRemove the redundant call.\n\nAnd take \u0026lock around zone_cond_store() in the two store wrappers to\nserialize dev-\u003ezones check-and-deref against its alloc/free, which already\nrun under \u0026lock. The reason there was no problem before is that only\nnullb_device_release() or null_exit() frees the dev-\u003ezones, which\nguarantees that subsequent users won\u0027t access the configfs interface."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-21T12:50:23.541Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/08a31a2cc3d1cea67ccd292d01511cd0a72d4656"
        },
        {
          "url": "https://git.kernel.org/stable/c/056be41932c95aabdb3c2967d1ef4978f17a0225"
        },
        {
          "url": "https://git.kernel.org/stable/c/b2437d37fcc31fce8a5da1cc1739e284814d2491"
        },
        {
          "url": "https://git.kernel.org/stable/c/0a3afab87124171022fb3579502fa38ef5b311c9"
        },
        {
          "url": "https://git.kernel.org/stable/c/2a6357a9b935a34f5508618fee8a7fffbf7722a8"
        }
      ],
      "title": "null_blk: free zones array on device power-off",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-90187",
    "datePublished": "2026-09-17T16:07:09.683Z",
    "dateReserved": "2026-09-11T19:38:34.791Z",
    "dateUpdated": "2026-10-21T12:50:23.541Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.