CVE-2026-90150: pnfs/blocklayout: Fix device leaks on parse failure
In the Linux kernel, the following vulnerability has been resolved:
pnfs/blocklayout: Fix device leaks on parse failure
blparseconcat() and blparsestripe() allocate a child device array and then parse each child in turn. If parsing a child fails, the failed child is not counted in nrchildren and the parent may be left with a children array that blfreedevice() will not release when nrchildren is zero.
Release the failed child and the already parsed children before returning the error. Also make blfreedevice() release the child array whenever the children pointer is set, so that partially initialised concat or stripe devices are cleaned up correctly.
blparsescsi() can also fail after assigning d->bdevfile and dropping the file reference. Clear the pointer after fput() so that an outer cleanup path does not put it again.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.12.111-1 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 7.2.6-1 - Upgrade
Upgrade
debian/linux-6.12to a version that resolves this vulnerability.Fixed in 6.12.111-1~deb12u1 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.1.191 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.6.160 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.12.110 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.18.52 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 7.2.6 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.12.115-2Fixed in 7.2.12-1Fixed in 7.2.15-1 - Upgrade
Upgrade
debian/linux-6.12to a version that resolves this vulnerability.Fixed in 6.12.113-1~deb12u1 - Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-42.42 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1016.17 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1016.18 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1015.16 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1 - Operational
Update pnfs/blocklayout cleanup handling: make bl_free_device() release the child array whenever the children pointer is set; in bl_parse_concat() and bl_parse_stripe(), release the failed child and already parsed children before returning an error; and in bl_parse_scsi(), clear the bdev_file pointer after fput() so an outer cleanup path does not put it again.
Event History
Frequently Asked Questions
What conditions trigger the leak?
The leak occurs when parsing a child device fails while processing a pNFS block-layout concat or stripe device. A related failure path can occur in SCSI device parsing after a block-device file pointer has been assigned and its file reference dropped.
What is the practical impact of a failed parse?
Before the fix, partially initialized child-device arrays may not be released, leaking device-related allocations. The SCSI parsing error path could also leave a stale bdev_file pointer that an outer cleanup path may attempt to release again.
How can exposure be reduced if the fix cannot be applied immediately?
The provided information identifies the affected paths as pNFS block-layout parsing for concat, stripe, and SCSI devices. Reducing or avoiding use of those block-layout device configurations avoids the described parse-failure cleanup paths.