---
id: CVE-2026-90187
title: |-
  In the Linux kernel, the following vulnerability has been resolved:

  null_blk: free zones array on device power-off

  null_init_zoned_dev() allocates dev->zones when a zoned device is powered
  on, but null_del_dev() never frees it on power…
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  null_blk: free zones array on device power-off

  null_init_zoned_dev() allocates dev->zones when a zoned device is powered
  on, but null_del_dev() never frees it on power…
severity: medium
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= ca4b2a011948fae4e4d31490107db4926385a983 <
    056be41932c95aabdb3c2967d1ef4978f17a0225
  - >-
    Linux >= ca4b2a011948fae4e4d31490107db4926385a983 <
    b2437d37fcc31fce8a5da1cc1739e284814d2491
  - >-
    Linux >= ca4b2a011948fae4e4d31490107db4926385a983 <
    0a3afab87124171022fb3579502fa38ef5b311c9
  - >-
    Linux >= ca4b2a011948fae4e4d31490107db4926385a983 <
    2a6357a9b935a34f5508618fee8a7fffbf7722a8
  - Linux 4.19
published: '2026-09-17'
updated: '2026-09-17'
sourceUpdated: '2026-09-17T17:17:13.270'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-90187'
references:
  - url: 'https://git.kernel.org/stable/c/056be41932c95aabdb3c2967d1ef4978f17a0225'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/0a3afab87124171022fb3579502fa38ef5b311c9'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/2a6357a9b935a34f5508618fee8a7fffbf7722a8'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/b2437d37fcc31fce8a5da1cc1739e284814d2491'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: >-
      https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-90187.json
  - url: 'https://access.redhat.com/security/cve/CVE-2026-90187'
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2536147'
  - url: 'https://www.cve.org/CVERecord?id=CVE-2026-90187'
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-90187'
  - url: >-
      https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-90187.mbox
  - url: 'https://git.kernel.org/stable/c/08a31a2cc3d1cea67ccd292d01511cd0a72d4656'
tags:
  - nvd
  - cve.org
  - csaf
  - vex
  - red-hat
ingestedAt: '2026-09-17T16:21:47.864Z'
epss: 0.00201
epssPercentile: 0.09869
cvss: 5.5
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'
cvssSource: vendor
cwe:
  - CWE-772
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

null_blk: free zones array on device power-off

null_init_zoned_dev() allocates dev->zones when a zoned device is powered
on, but null_del_dev() never frees it on power-off; dev->zones is only
freed later in null_free_dev(), when the configfs directory is removed. If
the device is powered off and then on again, null_init_zoned_dev()
allocates a new array and overwrites the dev->zones pointer, leaking the
previous allocation each power cycle.

Free dev->zones in null_del_dev() via null_free_zoned_dev() to solve it.
And calling null_free_zoned_dev() in null_free_dev() is no longer necessary
because every caller already invokes null_del_dev() first: via
nullb_group_drop_item() before nullb_device_release(), in the
null_add_dev() error path of null_create_dev(), and in null_destroy_dev().
Remove the redundant call.

And take &lock around zone_cond_store() in the two store wrappers to
serialize dev->zones check-and-deref against its alloc/free, which already
run under &lock. The reason there was no problem before is that only
nullb_device_release() or null_exit() frees the dev->zones, which
guarantees that subsequent users won't access the configfs interface.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

## Vendor advisories

- **Red Hat VEX** · Low · affected: Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 9, Red Hat OpenShift Container Platform 4 · no fix planned: Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 9, Red Hat OpenShift Container Platform 4 · updated 2026-10-05 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-90187.json)