{"id":"CVE-2026-90187","summary":"null_blk: free zones array on device power-off","details":"In the Linux kernel, the following vulnerability has been resolved:\n\nnull_blk: free zones array on device power-off\n\nnull_init_zoned_dev() allocates dev-\u003ezones when a zoned device is powered\non, but null_del_dev() never frees it on power-off; dev-\u003ezones is only\nfreed later in null_free_dev(), when the configfs directory is removed. If\nthe device is powered off and then on again, null_init_zoned_dev()\nallocates a new array and overwrites the dev-\u003ezones pointer, leaking the\nprevious allocation each power cycle.\n\nFree dev-\u003ezones in null_del_dev() via null_free_zoned_dev() to solve it.\nAnd calling null_free_zoned_dev() in null_free_dev() is no longer necessary\nbecause every caller already invokes null_del_dev() first: via\nnullb_group_drop_item() before nullb_device_release(), in the\nnull_add_dev() error path of null_create_dev(), and in null_destroy_dev().\nRemove the redundant call.\n\nAnd take &lock around zone_cond_store() in the two store wrappers to\nserialize dev-\u003ezones check-and-deref against its alloc/free, which already\nrun under &lock. The reason there was no problem before is that only\nnullb_device_release() or null_exit() frees the dev-\u003ezones, which\nguarantees that subsequent users won't access the configfs interface.","modified":"2026-09-19T03:47:25.006948250Z","published":"2026-09-17T16:07:09.683Z","database_specific":{"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/90xxx/CVE-2026-90187.json","cna_assigner":"Linux"},"references":[{"type":"WEB","url":"https://git.kernel.org/stable/c/056be41932c95aabdb3c2967d1ef4978f17a0225"},{"type":"WEB","url":"https://git.kernel.org/stable/c/0a3afab87124171022fb3579502fa38ef5b311c9"},{"type":"WEB","url":"https://git.kernel.org/stable/c/2a6357a9b935a34f5508618fee8a7fffbf7722a8"},{"type":"WEB","url":"https://git.kernel.org/stable/c/b2437d37fcc31fce8a5da1cc1739e284814d2491"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/90xxx/CVE-2026-90187.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-90187"},{"type":"PACKAGE","url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","events":[{"introduced":"ca4b2a011948fae4e4d31490107db4926385a983"},{"fixed":"056be41932c95aabdb3c2967d1ef4978f17a0225"},{"fixed":"b2437d37fcc31fce8a5da1cc1739e284814d2491"},{"fixed":"0a3afab87124171022fb3579502fa38ef5b311c9"},{"fixed":"2a6357a9b935a34f5508618fee8a7fffbf7722a8"}]}],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-90187.json"}},{"package":{"name":"Kernel","ecosystem":"Linux"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.19.0"},{"fixed":"6.12.110"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.13.0"},{"fixed":"6.18.52"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.19.0"},{"fixed":"7.2.6"}]}],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-90187.json"}}],"schema_version":"1.9.0"}