{"id":"CVE-2026-90187","title":"In the Linux kernel, the following vulnerability has been resolved:\n\nnull_blk: free zones array on device power-off\n\nnull_init_zoned_dev() allocates dev->zones when a zoned device is powered\non, but null_del_dev() never frees it on power…","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nnull_blk: free zones array on device power-off\n\nnull_init_zoned_dev() allocates dev->zones when a zoned device is powered\non, but null_del_dev() never frees it on power…","severity":"none","vendor":"Linux","product":"Linux","affected":["Linux >= ca4b2a011948fae4e4d31490107db4926385a983 < 056be41932c95aabdb3c2967d1ef4978f17a0225","Linux >= ca4b2a011948fae4e4d31490107db4926385a983 < b2437d37fcc31fce8a5da1cc1739e284814d2491","Linux >= ca4b2a011948fae4e4d31490107db4926385a983 < 0a3afab87124171022fb3579502fa38ef5b311c9","Linux >= ca4b2a011948fae4e4d31490107db4926385a983 < 2a6357a9b935a34f5508618fee8a7fffbf7722a8","Linux 4.19"],"published":"2026-09-17","updated":"2026-09-17","sourceUpdated":"2026-09-17T17:17:13.270","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-90187","references":[{"url":"https://git.kernel.org/stable/c/056be41932c95aabdb3c2967d1ef4978f17a0225","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/0a3afab87124171022fb3579502fa38ef5b311c9","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/2a6357a9b935a34f5508618fee8a7fffbf7722a8","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/b2437d37fcc31fce8a5da1cc1739e284814d2491","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"tags":["nvd","cve.org"],"ingestedAt":"2026-09-17T16:21:47.864Z","epss":0.002,"epssPercentile":0.10159,"slug":"CVE-2026-90187","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nnull_blk: free zones array on device power-off\n\nnull_init_zoned_dev() allocates dev->zones when a zoned device is powered\non, but null_del_dev() never frees it on power-off; dev->zones is only\nfreed later in null_free_dev(), when the configfs directory is removed. If\nthe device is powered off and then on again, null_init_zoned_dev()\nallocates a new array and overwrites the dev->zones pointer, leaking the\nprevious allocation each power cycle.\n\nFree dev->zones in null_del_dev() via null_free_zoned_dev() to solve it.\nAnd calling null_free_zoned_dev() in null_free_dev() is no longer necessary\nbecause every caller already invokes null_del_dev() first: via\nnullb_group_drop_item() before nullb_device_release(), in the\nnull_add_dev() error path of null_create_dev(), and in null_destroy_dev().\nRemove the redundant call.\n\nAnd take &lock around zone_cond_store() in the two store wrappers to\nserialize dev->zones check-and-deref against its alloc/free, which already\nrun under &lock. The reason there was no problem before is that only\nnullb_device_release() or null_exit() frees the dev->zones, which\nguarantees that subsequent users won't access the configfs interface.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":3,"depthScoreParts":{"impact":2.8,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}