CVE-2026-23032: null_blk: fix kmemleak by releasing references to fault configfs items

Published Jan 31, 2026
·
Updated

In the Linux kernel, the following vulnerability has been resolved:

nullblk: fix kmemleak by releasing references to fault configfs items

When CONFIGBLKDEVNULLBLKFAULTINJECTION is enabled, the null-blk driver sets up fault injection support by creating the timeoutinject, requeueinject, and inithctxfaultinject configfs items as children of the top-level nullbX configfs group.

However, when the nullbX device is removed, the references taken to these fault-config configfs items are not released. As a result, kmemleak reports a memory leak, for example:

unreferenced object 0xc00000021ff25c40 (size 32): comm "mkdir", pid 10665, jiffies 4322121578 hex dump (first 32 bytes): 69 6e 69 74 5f 68 63 74 78 5f 66 61 75 6c 74 5f inithctxfault 69 6e 6a 65 63 74 00 88 00 00 00 00 00 00 00 00 inject.......... backtrace (crc 1a018c86): kmallocnodetrackcallernoprof+0x494/0xbd8 kvasprintf+0x74/0xf4 configitemsetname+0xf0/0x104 configgroupinittypename+0x48/0xfc faultconfiginit+0x48/0xf0 0xc0080000180559e4 configfsmkdir+0x304/0x814 vfsmkdir+0x49c/0x604 domkdirat+0x314/0x3d0 sysmkdir+0xa0/0xd8 systemcallexception+0x1b0/0x4f0 systemcallvectoredcommon+0x15c/0x2ec

Fix this by explicitly releasing the references to the fault-config configfs items when dropping the reference to the top-level nullbX configfs group.

Affected Software

2 affected componentsFixes available
linux/kernel
debian/linux
6.1.176-16.1.190-16.12.107-16.12.115-27.2.12-17.2.15-1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

  1. Upgrade

    Upgrade debian/linux to a version that resolves this vulnerability.

    Fixed in 6.1.176-1Fixed in 6.1.190-1Fixed in 6.12.107-1Fixed in 6.12.113-1Fixed in 7.2.12-1Fixed in 7.2.13-1

Event History

Jan 31, 2026
CVE Published
via MITRE·11:42 AM
Data Sourced
via MITRE·11:42 AM
Description
Data Sourced
via NVD·12:16 PM
Description

Parent advisories

This vulnerability appears in the following advisories.

Frequently Asked Questions

1

What is the severity of CVE-2026-23032?

CVE-2026-23032 is classified as a high severity vulnerability due to the risk of memory leaks.

2

How do I fix CVE-2026-23032?

To fix CVE-2026-23032, ensure that you update to the latest version of the Linux kernel that addresses this issue.

3

What component is affected by CVE-2026-23032?

CVE-2026-23032 affects the null_blk driver in the Linux kernel.

4

What condition triggers CVE-2026-23032?

CVE-2026-23032 is triggered when CONFIG_BLK_DEV_NULL_BLK_FAULT_INJECTION is enabled.

5

What are the implications of CVE-2026-23032 for system stability?

CVE-2026-23032 can lead to potential system instability due to memory leaks if not addressed.

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203