Executive brief
The Linux kernel's null_blk module contains a memory leak when shared tags are enabled and device initialization fails. If module setup fails partway through, memory allocated for the global tag_set is not properly freed, wasting system resources. This occurs only during exceptional error conditions during module loading.
Technical details
The vulnerability is a resource leak (CWE-401) in the null_blk block device driver module. When shared_tags is enabled, null_setup_tagset() allocates a global tag_set via null_init_global_tag_set(). If device creation fails afterwards, the err_dev error path destroys devices and unregisters the block device but fails to free the global tag_set; since module init failed, null_exit() is never called to clean up. The fix adds a blk_mq_free_tag_set() call in the error path. The vulnerability requires the module to be loaded with shared_tags enabled and device initialization to fail, which is an uncommon scenario. No network or privilege escalation is possible; impact is limited to kernel memory waste on affected systems.
Affected products
- Linux Linux kernel multiple versions (see upstream commit 5a1c5ff3a49ba93a1fd0b70537e7a0164071760d)
Timeline
- 2026-09-17: disclosed: Published in NVD
- 2026-09-14: patched: Patches committed to stable kernel trees