Executive brief
The Linux kernel's null_blk block device driver contains a race condition when loaded as a module. If a user attempts to configure a virtual block device before the module finishes initialization, the driver can crash or trigger a use-after-free vulnerability. This could allow a local user to cause a kernel crash or potentially execute code with elevated privileges.
Technical details
The vulnerability is a race condition in the null_blk module initialization. The configfs_register_subsystem() function is called before register_blkdev(), allowing a racing mkdir() and poweron from userspace to reach null_add_dev() while null_major is still uninitialized (0). This causes __add_disk() to hit a WARN_ON check that fails because the disk has minors but no valid major device number. Additionally, the error path destroys all devices while configfs is still registered, potentially freeing a user device's nullb_device structure while the corresponding /sys/kernel/config/nullb entry remains accessible, triggering a use-after-free. The fix reorders initialization to register the configfs subsystem after creating default devices and allocating the block device major number.
Affected products
- Linux Linux kernel 7.2.0-rc1 and likely others
Timeline
- 2026-09-17: disclosed