Executive brief
The null_blk block device driver in the Linux kernel has a memory leak when a zoned storage device is powered off and on repeatedly. Each power cycle that reallocates the zones array without freeing the previous allocation gradually consumes system memory, potentially degrading performance or availability over time.
Technical details
The vulnerability is a memory leak in the null_blk driver's zone management. The null_init_zoned_dev() function allocates a dev->zones array when a zoned device powers on, but null_del_dev() failed to free it on power-off; the memory was only released during device teardown in null_free_dev(). Repeated power cycles caused the dev->zones pointer to be overwritten without freeing the prior allocation. The fix moves the null_free_zoned_dev() call from null_free_dev() to null_del_dev() to properly free the zones array at power-off, and adds mutex locking around zone_cond_store() operations to prevent use-after-free races. This is a kernel memory management bug requiring local access to trigger (via configfs interface manipulation).
Affected products
- Linux Linux Kernel before commit 2a6357a9b935a34f5508618fee8a7fffbf7722a8
Timeline
- 2026-09-17: disclosed
- 2026-07-25: patched: upstream fix commit 2a6357a9b935a34f5508618fee8a7fffbf7722a8