CVE-2026-90150: pnfs/blocklayout: Fix device leaks on parse failure
In the Linux kernel, the following vulnerability has been resolved:
pnfs/blocklayout: Fix device leaks on parse failure
blparseconcat() and blparsestripe() allocate a child device array and then parse each child in turn. If parsing a child fails, the failed child is not counted in nrchildren and the parent may be left with a children array that blfreedevice() will not release when nrchildren is zero.
Release the failed child and the already parsed children before returning the error. Also make blfreedevice() release the child array whenever the children pointer is set, so that partially initialised concat or stripe devices are cleaned up correctly.
blparsescsi() can also fail after assigning d->bdevfile and dropping the file reference. Clear the pointer after fput() so that an outer cleanup path does not put it again.
Affected Software
Event History
Frequently Asked Questions
What conditions trigger the leak?
The leak occurs when parsing a child device fails while processing a pNFS block-layout concat or stripe device. A related failure path can occur in SCSI device parsing after a block-device file pointer has been assigned and its file reference dropped.
What is the practical impact of a failed parse?
Before the fix, partially initialized child-device arrays may not be released, leaking device-related allocations. The SCSI parsing error path could also leave a stale bdev_file pointer that an outer cleanup path may attempt to release again.
How can exposure be reduced if the fix cannot be applied immediately?
The provided information identifies the affected paths as pNFS block-layout parsing for concat, stripe, and SCSI devices. Reducing or avoiding use of those block-layout device configurations avoids the described parse-failure cleanup paths.