Executive brief
A memory leak vulnerability was identified in the Linux kernel's null block device driver. When specific fault injection features are enabled, the system fails to properly clean up memory when a device is removed. Over time, this could lead to a gradual depletion of system memory, potentially causing performance issues or system instability.
Technical details
A memory leak (kmemleak) exists in drivers/block/null_blk/main.c of the Linux kernel. When CONFIG_BLK_DEV_NULL_BLK_FAULT_INJECTION is enabled, the driver creates several configfs items (timeout_inject, requeue_inject, and init_hctx_fault_inject) as children of the nullbX group. The vulnerability occurs because the driver fails to call config_item_put() on these fault-config items when the parent nullbX device is removed. A local attacker with permissions to create and remove null_blk devices via configfs could repeatedly trigger this leak to exhaust system memory. The issue has been resolved by adding a nullb_del_fault_config() function to explicitly release these references during the drop_item phase.
Affected products
- Linux Linux Kernel Fixed in 6.1.127, 6.6.74, 6.12.11, 6.13+
Timeline
- 2026-01-13: patched: Initial fix committed to kernel tree
- 2026-01-31: disclosed: CVE published
References
- https://git.kernel.org/stable/c/1a3286edf4d48ce37f8982ff3c3b65159a5ecbb2
- https://git.kernel.org/stable/c/40b94ec7edbbb867c4e26a1a43d2b898f04b93c5
- https://git.kernel.org/stable/c/d59ba448ccd595d5d65e197216cf781a87db2b28
- https://git.kernel.org/stable/c/f1718da051282698aa8fa150bebb9724f6389fda
- https://cert-portal.siemens.com/productcert/html/ssa-253495.html