Executive brief
The Linux kernel's null_blk null block device driver has a race condition in its poll request timeout handling. When I/O requests timeout during high-performance I/O operations (such as benchmarks), the kernel can crash due to a NULL pointer dereference, causing system instability and potential service interruption on affected systems.
Technical details
A race condition exists in null_blk between the null_timeout_rq() timeout handler and null_poll() request polling function. When a poll request times out while being processed by null_poll(), the request state is not properly synchronized, leading to a NULL pointer dereference in the timeout handler. The vulnerability is triggered during io_uring benchmarking on /dev/nullb0 when poll request timeouts occur. The root cause is insufficient locking protection around request state transitions; the fix adds protection under nq->poll_lock to set requests to MQ_RQ_COMPLETE state, allowing null_timeout_rq() to safely detect and handle the race condition by early returning.
Affected products
- Linux Linux kernel kernel versions with null_blk driver prior to patch
Timeline
- 2025-10-01: disclosed
- 2023: patched