CVE-2026-90187

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

null_blk: free zones array on device power-off

null_init_zoned_dev() allocates dev->zones when a zoned device is powered

on, but null_del_dev() never frees it on power-off; dev->zones is only

freed later in null_free_dev(), when the configfs directory is removed. If

the device is powered off and then on again, null_init_zoned_dev()

allocates a new array and overwrites the dev->zones pointer, leaking the

previous allocation each power cycle.

Free dev->zones in null_del_dev() via null_free_zoned_dev() to solve it.

And calling null_free_zoned_dev() in null_free_dev() is no longer necessary

because every caller already invokes null_del_dev() first: via

nullb_group_drop_item() before nullb_device_release(), in the

null_add_dev() error path of null_create_dev(), and in null_destroy_dev().

Remove the redundant call.

And take &lock around zone_cond_store() in the two store wrappers to

serialize dev->zones check-and-deref a

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References