GHSA-45HH-QMFR-M7PJ
Vulnerability from github – Published: 2026-09-17 18:31 – Updated: 2026-09-17 18:31In the Linux kernel, the following vulnerability has been resolved:
null_blk: free zones array on device power-off
null_init_zoned_dev() allocates dev->zones when a zoned device is powered on, but null_del_dev() never frees it on power-off; dev->zones is only freed later in null_free_dev(), when the configfs directory is removed. If the device is powered off and then on again, null_init_zoned_dev() allocates a new array and overwrites the dev->zones pointer, leaking the previous allocation each power cycle.
Free dev->zones in null_del_dev() via null_free_zoned_dev() to solve it. And calling null_free_zoned_dev() in null_free_dev() is no longer necessary because every caller already invokes null_del_dev() first: via nullb_group_drop_item() before nullb_device_release(), in the null_add_dev() error path of null_create_dev(), and in null_destroy_dev(). Remove the redundant call.
And take &lock around zone_cond_store() in the two store wrappers to serialize dev->zones check-and-deref against its alloc/free, which already run under &lock. The reason there was no problem before is that only nullb_device_release() or null_exit() frees the dev->zones, which guarantees that subsequent users won't access the configfs interface.
{
"affected": [],
"aliases": [
"CVE-2026-90187"
],
"database_specific": {
"cwe_ids": [],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-09-17T17:17:13Z",
"severity": null
},
"details": "In the Linux kernel, the following vulnerability has been resolved:\n\nnull_blk: free zones array on device power-off\n\nnull_init_zoned_dev() allocates dev-\u003ezones when a zoned device is powered\non, but null_del_dev() never frees it on power-off; dev-\u003ezones is only\nfreed later in null_free_dev(), when the configfs directory is removed. If\nthe device is powered off and then on again, null_init_zoned_dev()\nallocates a new array and overwrites the dev-\u003ezones pointer, leaking the\nprevious allocation each power cycle.\n\nFree dev-\u003ezones in null_del_dev() via null_free_zoned_dev() to solve it.\nAnd calling null_free_zoned_dev() in null_free_dev() is no longer necessary\nbecause every caller already invokes null_del_dev() first: via\nnullb_group_drop_item() before nullb_device_release(), in the\nnull_add_dev() error path of null_create_dev(), and in null_destroy_dev().\nRemove the redundant call.\n\nAnd take \u0026lock around zone_cond_store() in the two store wrappers to\nserialize dev-\u003ezones check-and-deref against its alloc/free, which already\nrun under \u0026lock. The reason there was no problem before is that only\nnullb_device_release() or null_exit() frees the dev-\u003ezones, which\nguarantees that subsequent users won\u0027t access the configfs interface.",
"id": "GHSA-45hh-qmfr-m7pj",
"modified": "2026-09-17T18:31:54Z",
"published": "2026-09-17T18:31:54Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-90187"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/056be41932c95aabdb3c2967d1ef4978f17a0225"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/0a3afab87124171022fb3579502fa38ef5b311c9"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/2a6357a9b935a34f5508618fee8a7fffbf7722a8"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/b2437d37fcc31fce8a5da1cc1739e284814d2491"
}
],
"schema_version": "1.4.0",
"severity": []
}
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
Related by attack behaviour
Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.