CVE-2026-90188: null_blk: free global tag_set on init error path
In the Linux kernel, the following vulnerability has been resolved:
nullblk: free global tagset on init error path
If sharedtags is enabled, nullsetuptagset() allocates the global tagset via nullinitglobaltagset(). If device creation later fails, errdev destroys the default devices and calls unregisterblkdev(), but never frees the global tagset. Since module init failed, nullexit() is never invoked, so the global tagset's tags and maps are permanently leaked.
Free the global tagset in errdev, matching nullexit() which does if (tagset.ops) blkmqfreetagset(&tagset).
Affected Software
Event History
Frequently Asked Questions
Under what conditions can this issue occur?
It can occur when the null_blk module is initialized with shared_tags enabled, the global tag_set is allocated, and later device creation fails. The module initialization then fails before its normal exit routine can run.
What is the operational impact of a failed initialization in this state?
The global tag_set, including its tags and maps, remains permanently leaked because the initialization error path does not free it.