Executive brief
The Linux kernel's null_blk block device driver has a race condition in its configuration interface that can occur when multiple processes attempt to modify device settings concurrently. This can cause device state to become corrupted or inconsistent, potentially leading to memory access violations or system instability. The vulnerability requires local access to the configfs interface and affects systems using the null_blk module for testing or virtualization.
Technical details
The vulnerability is a missing synchronization issue (CWE-366: Race Condition) in the NULLB_DEVICE_ATTR_store macro within drivers/block/null_blk/main.c. The macro accepts concurrent configfs attribute writes without proper locking, allowing multiple threads to modify device configuration fields simultaneously. For apply_fn attributes (submit_queues, poll_queues), the hardware reconfiguration can be overwritten after the function returns; for other attributes, configuration can be modified mid-setup before the CONFIGURED flag is set, leading to out-of-bounds array access (e.g., zone_nr_conv exceeding nr_zones). The fix moves the mutex lock from individual apply functions into the macro itself to serialize all stores. Local attacker with access to configfs can trigger memory corruption or denial of service.
Affected products
- Linux Linux kernel multiple versions (fix backported across stable branches)
Timeline
- 2026-09-17: disclosed
- 2026-07-25: patched: Upstream patch commit 7e7fff51808237703a3a1df6dd5cae1dfd1db86d