Executive brief
The Linux kernel's null_blk module has a race condition where configuration changes can happen while a device is being initialized, leading to inconsistent state and device setup failures. This could cause system instability or block device operations to fail unexpectedly.
Technical details
A race condition exists in the null_blk kernel module where attribute store methods lack proper synchronization with device initialization (null_add_dev()). The NULLB_DEV_FL_CONFIGURED flag check is not protected by locks, and configfs only serializes writes to the same file handle, allowing concurrent attribute modifications during device setup. An attacker with local access to configfs attributes can modify device configuration (e.g., toggling zoned mode) while null_add_dev() reads the same values, causing mismatched queue feature flags and zone resource initialization. This results in failed device setup with -EIO errors or dangling NULL pointers in zone processing code. The fix adds mutex protection around both the configuration flag check and updates, and initializes the lock statically to prevent races during module initialization.
Affected products
- Linux Linux kernel prior to fix
Timeline
- 2026-09-17: disclosed