Executive brief
The Linux kernel's null_blk (null block device) driver has a race condition where userspace can trigger file operations on an uninitialized mutex, causing kernel warnings and potential instability. The null_blk driver is a testing and benchmarking utility that simulates a block device, and this flaw could be exploited by local users with filesystem access to trigger unexpected kernel behavior.
Technical details
This is a race condition in the Linux kernel's null_blk driver where mutex_init(&lock) is called after configfs_register_subsystem(), exposing the nullb subsystem to userspace before the mutex is fully initialized. A concurrent mkdir() syscall on /sys/kernel/config/nullb/ can trigger null_find_dev_by_name() -> mutex_lock(&lock) before the mutex is initialized, causing a DEBUG_LOCKS_WARN_ON warning in kernel/locking/mutex.c. The vulnerability allows local privileged or unprivileged users to trigger this race condition via configfs filesystem operations. The fix replaces runtime mutex_init() with static DEFINE_MUTEX() declaration, ensuring the mutex is initialized at compile time rather than at module load time.
Affected products
- Linux Linux kernel multiple versions with null_blk driver
Timeline
- 2026-09-17: disclosed: Published in NVD
- 2026-08-15: patched: Commit 017dac7670909eaea3eb36e6b3b5a8be9ce0a14d merged by Jens Axboe