CVE-2026-90187: null_blk: free zones array on device power-off
In the Linux kernel, the following vulnerability has been resolved:
nullblk: free zones array on device power-off
nullinitzoneddev() allocates dev->zones when a zoned device is powered on, but nulldeldev() never frees it on power-off; dev->zones is only freed later in nullfreedev(), when the configfs directory is removed. If the device is powered off and then on again, nullinitzoneddev() allocates a new array and overwrites the dev->zones pointer, leaking the previous allocation each power cycle.
Free dev->zones in nulldeldev() via nullfreezoneddev() to solve it. And calling nullfreezoneddev() in nullfreedev() is no longer necessary because every caller already invokes nulldeldev() first: via nullbgroupdropitem() before nullbdevicerelease(), in the nulladddev() error path of nullcreatedev(), and in nulldestroydev(). Remove the redundant call.
And take &lock around zonecondstore() in the two store wrappers to serialize dev->zones check-and-deref against its alloc/free, which already run under &lock. The reason there was no problem before is that only nullbdevicerelease() or nullexit() frees the dev->zones, which guarantees that subsequent users won't access the configfs interface.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.12.111-1 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 7.2.6-1 - Upgrade
Upgrade
debian/linux-6.12to a version that resolves this vulnerability.Fixed in 6.12.111-1~deb12u1 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.1.191 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.6.160 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.12.110 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.18.52 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 7.2.6 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.12.115-2Fixed in 7.2.12-1Fixed in 7.2.15-1 - Upgrade
Upgrade
debian/linux-6.12to a version that resolves this vulnerability.Fixed in 6.12.113-1~deb12u1 - Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-42.42 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1016.17 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1016.18 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1015.16 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1
Event History
Frequently Asked Questions
Which systems are exposed to the memory leak?
Systems using the Linux kernel null_blk driver with a zoned device are affected when that device is powered off and then powered on again. Each such power cycle can allocate a new zones array while losing the pointer to the prior allocation.
What happens if the device is removed instead of power-cycled?
The zones array is freed when the device's configfs directory is removed through device cleanup. The leak occurs specifically because power-off did not previously free the array before a later power-on allocated a replacement.
What additional synchronization issue does the fix address?
The fix serializes zone_cond_store() checks and dereferences of dev->zones with allocation and freeing of that array. This prevents concurrent store operations from accessing dev->zones while it is being allocated or freed during device state changes.