{"id":"CVE-2026-90187","state":"PUBLISHED","title":"null_blk: free zones array on device power-off","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nnull_blk: free zones array on device power-off\n\nnull_init_zoned_dev() allocates dev->zones when a zoned device is powered\non, but null_del_dev() never frees it on power-off; dev->zones is only\nfreed later in null_free_dev(), when the configfs directory is removed. If\nthe device is powered off and then on again, null_init_zoned_dev()\nallocates a new array and overwrites the dev->zones pointer, leaking the\nprevious allocation each power cycle.\n\nFree dev->zones in null_del_dev() via null_free_zoned_dev() to solve it.\nAnd calling null_free_zoned_dev() in null_free_dev() is no longer necessary\nbecause every caller already invokes null_del_dev() first: via\nnullb_group_drop_item() before nullb_device_release(), in the\nnull_add_dev() error path of null_create_dev(), and in null_destroy_dev().\nRemove the redundant call.\n\nAnd take &lock around zone_cond_store() in the two store wrappers to\nserialize dev->zones check-and-deref against its alloc/free, which already\nrun under &lock. The reason there was no problem before is that only\nnullb_device_release() or null_exit() frees the dev->zones, which\nguarantees that subsequent users won't access the configfs interface.","publishedAt":"2026-09-17T16:07:09.683Z","updatedAt":"2026-10-30T12:34:40.977Z","severity":null,"assigner":"Linux","products":["Linux Linux"],"affected":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","versions":[{"version":"ca4b2a011948fae4e4d31490107db4926385a983","status":"affected","lessThan":"26d21585caa61c30d0f3044a1e6d172456148c9f","versionType":"git"},{"version":"ca4b2a011948fae4e4d31490107db4926385a983","status":"affected","lessThan":"08a31a2cc3d1cea67ccd292d01511cd0a72d4656","versionType":"git"},{"version":"ca4b2a011948fae4e4d31490107db4926385a983","status":"affected","lessThan":"056be41932c95aabdb3c2967d1ef4978f17a0225","versionType":"git"},{"version":"ca4b2a011948fae4e4d31490107db4926385a983","status":"affected","lessThan":"b2437d37fcc31fce8a5da1cc1739e284814d2491","versionType":"git"},{"version":"ca4b2a011948fae4e4d31490107db4926385a983","status":"affected","lessThan":"0a3afab87124171022fb3579502fa38ef5b311c9","versionType":"git"},{"version":"ca4b2a011948fae4e4d31490107db4926385a983","status":"affected","lessThan":"2a6357a9b935a34f5508618fee8a7fffbf7722a8","versionType":"git"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/block/null_blk/main.c"]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","versions":[{"version":"4.19","status":"affected"},{"version":"0","status":"unaffected","lessThan":"4.19","versionType":"semver"},{"version":"6.1.191","status":"unaffected","lessThanOrEqual":"6.1.*","versionType":"semver"},{"version":"6.6.160","status":"unaffected","lessThanOrEqual":"6.6.*","versionType":"semver"},{"version":"6.12.110","status":"unaffected","lessThanOrEqual":"6.12.*","versionType":"semver"},{"version":"6.18.52","status":"unaffected","lessThanOrEqual":"6.18.*","versionType":"semver"},{"version":"7.2.6","status":"unaffected","lessThanOrEqual":"7.2.*","versionType":"semver"},{"version":"7.3","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/block/null_blk/main.c"]}],"references":["https://git.kernel.org/stable/c/26d21585caa61c30d0f3044a1e6d172456148c9f","https://git.kernel.org/stable/c/08a31a2cc3d1cea67ccd292d01511cd0a72d4656","https://git.kernel.org/stable/c/056be41932c95aabdb3c2967d1ef4978f17a0225","https://git.kernel.org/stable/c/b2437d37fcc31fce8a5da1cc1739e284814d2491","https://git.kernel.org/stable/c/0a3afab87124171022fb3579502fa38ef5b311c9","https://git.kernel.org/stable/c/2a6357a9b935a34f5508618fee8a7fffbf7722a8"],"weaknesses":[],"ingestedAt":"2026-10-30T12:54:04.478Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2026/90xxx/CVE-2026-90187.json","commit":"1f312381e38164a43607eebab851b151dd16861e","baselineCommit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-90187","state":"PUBLISHED","datePublished":"2026-09-17T16:07:09.683Z","dateUpdated":"2026-10-30T12:34:40.977Z","assignerShortName":"Linux","assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","dateReserved":"2026-09-11T19:38:34.791Z"},"containers":{"cna":{"title":"null_blk: free zones array on device power-off","descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nnull_blk: free zones array on device power-off\n\nnull_init_zoned_dev() allocates dev->zones when a zoned device is powered\non, but null_del_dev() never frees it on power-off; dev->zones is only\nfreed later in null_free_dev(), when the configfs directory is removed. If\nthe device is powered off and then on again, null_init_zoned_dev()\nallocates a new array and overwrites the dev->zones pointer, leaking the\nprevious allocation each power cycle.\n\nFree dev->zones in null_del_dev() via null_free_zoned_dev() to solve it.\nAnd calling null_free_zoned_dev() in null_free_dev() is no longer necessary\nbecause every caller already invokes null_del_dev() first: via\nnullb_group_drop_item() before nullb_device_release(), in the\nnull_add_dev() error path of null_create_dev(), and in null_destroy_dev().\nRemove the redundant call.\n\nAnd take &lock around zone_cond_store() in the two store wrappers to\nserialize dev->zones check-and-deref against its alloc/free, which already\nrun under &lock. The reason there was no problem before is that only\nnullb_device_release() or null_exit() frees the dev->zones, which\nguarantees that subsequent users won't access the configfs interface."}],"affected":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","versions":[{"version":"ca4b2a011948fae4e4d31490107db4926385a983","status":"affected","lessThan":"26d21585caa61c30d0f3044a1e6d172456148c9f","versionType":"git"},{"version":"ca4b2a011948fae4e4d31490107db4926385a983","status":"affected","lessThan":"08a31a2cc3d1cea67ccd292d01511cd0a72d4656","versionType":"git"},{"version":"ca4b2a011948fae4e4d31490107db4926385a983","status":"affected","lessThan":"056be41932c95aabdb3c2967d1ef4978f17a0225","versionType":"git"},{"version":"ca4b2a011948fae4e4d31490107db4926385a983","status":"affected","lessThan":"b2437d37fcc31fce8a5da1cc1739e284814d2491","versionType":"git"},{"version":"ca4b2a011948fae4e4d31490107db4926385a983","status":"affected","lessThan":"0a3afab87124171022fb3579502fa38ef5b311c9","versionType":"git"},{"version":"ca4b2a011948fae4e4d31490107db4926385a983","status":"affected","lessThan":"2a6357a9b935a34f5508618fee8a7fffbf7722a8","versionType":"git"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/block/null_blk/main.c"]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","versions":[{"version":"4.19","status":"affected"},{"version":"0","status":"unaffected","lessThan":"4.19","versionType":"semver"},{"version":"6.1.191","status":"unaffected","lessThanOrEqual":"6.1.*","versionType":"semver"},{"version":"6.6.160","status":"unaffected","lessThanOrEqual":"6.6.*","versionType":"semver"},{"version":"6.12.110","status":"unaffected","lessThanOrEqual":"6.12.*","versionType":"semver"},{"version":"6.18.52","status":"unaffected","lessThanOrEqual":"6.18.*","versionType":"semver"},{"version":"7.2.6","status":"unaffected","lessThanOrEqual":"7.2.*","versionType":"semver"},{"version":"7.3","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/block/null_blk/main.c"]}],"references":[{"url":"https://git.kernel.org/stable/c/26d21585caa61c30d0f3044a1e6d172456148c9f"},{"url":"https://git.kernel.org/stable/c/08a31a2cc3d1cea67ccd292d01511cd0a72d4656"},{"url":"https://git.kernel.org/stable/c/056be41932c95aabdb3c2967d1ef4978f17a0225"},{"url":"https://git.kernel.org/stable/c/b2437d37fcc31fce8a5da1cc1739e284814d2491"},{"url":"https://git.kernel.org/stable/c/0a3afab87124171022fb3579502fa38ef5b311c9"},{"url":"https://git.kernel.org/stable/c/2a6357a9b935a34f5508618fee8a7fffbf7722a8"}],"providerMetadata":{"shortName":"Linux","orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","dateUpdated":"2026-10-30T12:34:40.977Z"},"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.19","versionEndExcluding":"6.1.191"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.19","versionEndExcluding":"6.6.160"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.19","versionEndExcluding":"6.12.110"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.19","versionEndExcluding":"6.18.52"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.19","versionEndExcluding":"7.2.6"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.19","versionEndExcluding":"7.3"}]}]}],"x_generator":{"engine":"bippy-1.2.0"}}}}}