CVE-2026-90187
UnknownSummary
In the Linux kernel, the null_blk module allocates the dev->zones array when a zoned device is powered on (null_init_zoned_dev()), but null_del_dev() never frees it on power-off — it is only freed later in null_free_dev() when the configfs directory is removed. Powering the device off and on again overwrites the dev->zones pointer, leaking the previous allocation on each power cycle.
Risk Assessment
Causes a memory leak on each power-off/on cycle of a zoned device, potentially leading to gradual kernel memory exhaustion.
Recommendation
Update the Linux kernel to a version where null_del_dev() frees dev->zones via null_free_zoned_dev(), removes the redundant call in null_free_dev(), and takes &lock around zone_cond_store().
Other vulnerabilities in Linux kernel
See all- CVE-2026-98163Unknown
A vulnerability was found in the Linux kernel's cgroup subsystem, involving iteration over dying tasks with a zero reference count. This leads to a race condition where the iterator may access a task after it has been freed, resulting in a use-after-free.
- CVE-2026-98162Unknown
In the Linux kernel, the smb2_tree_connect() function of the SMB server (ksmbd) leaks a tree connection. When ksmbd_iov_pin_rsp() fails, the newly created tree connection is not disconnected, leading to a resource leak.
- CVE-2026-98161Unknown
In the Linux kernel, the nvdimm (pmem) pmem_submit_bio() function records a REQ_PREFLUSH error but continues to copy bio data and can later overwrite the error with a successful REQ_FUA flush. This allows data writes to run after a failed preflush and can complete the bio successfully despite the failed ordering barrier.
- CVE-2026-98160Unknown
In the Linux kernel, the staging rtl8723bs driver's rtw_sdio_if1_init() function frees padapter->HalData with kfree(), even though it was allocated via vzalloc(). Using kfree() to release a vmalloc-backed buffer can lead to memory corruption.
- CVE-2026-100079Unknown
In the Linux kernel, the USB Type-C (ucsi) subsystem's ucsi_register() creates per-instance debugfs entries, but ucsi_unregister() keeps them until ucsi_destroy(). Drivers like ucsi_glink that unregister/register the same UCSI instance across remoteproc restart then try to create an already existing debugfs directory.
- CVE-2026-100078Unknown
In the Linux kernel, the iwlwifi (mei) driver's iwl_mei_write_cyclic_buf() function receives an incorrect first argument — the q_head pointer is passed instead of cldev. The bug has been fixed.
- CVE-2026-100077Unknown
In the Linux kernel, the drm/msm driver does not safely retire a hung submit before GPU recovery completes. Retiring the submit triggers BO free, which can result in GPU pagefaults since the GPU may be actively accessing those BOs.
- CVE-2026-100074Unknown
In the Linux kernel, a bug was fixed where the BPF_REFCOUNT field was not marked as unique, although it should be. The fix addresses this oversight.
- CVE-2026-100073Unknown
In the Linux kernel, a bug in the ext4 filesystem related to transaction overflow during writeback was fixed. A previous fix was too eager in reducing reserved transaction credits, leading to insufficient reservation in some corner cases. The fix uses ext4_meta_trans_blocks() for a correct upper bound estimate.
- CVE-2026-100072Unknown
In the Linux kernel, a problem in the ACPI subsystem was fixed where the use of acpi_get_first_physical_node() in acpi_platform_fill_resource() and acpi_create_platform_device() was unsafe because the returned device could be freed at any time. The fix replaces it with acpi_bus_get_primary_device() and adjusts the code to call it only once.
Original NVD description (English source)
In the Linux kernel, the following vulnerability has been resolved: null_blk: free zones array on device power-off null_init_zoned_dev() allocates dev->zones when a zoned device is powered on, but null_del_dev() never frees it on power-off; dev->zones is only freed later in null_free_dev(), when the configfs directory is removed. If the device is powered off and then on again, null_init_zoned_dev() allocates a new array and overwrites the dev->zones pointer, leaking the previous allocation each power cycle. Free dev->zones in null_del_dev() via null_free_zoned_dev() to solve it. And calling null_free_zoned_dev() in null_free_dev() is no longer necessary because every caller already invokes null_del_dev() first: via nullb_group_drop_item() before nullb_device_release(), in the null_add_dev() error path of null_create_dev(), and in null_destroy_dev(). Remove the redundant call. And take &lock around zone_cond_store() in the two store wrappers to serialize dev->zones check-and-deref against its alloc/free, which already run under &lock. The reason there was no problem before is that only nullb_device_release() or null_exit() frees the dev->zones, which guarantees that subsequent users won't access the configfs interface.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS