linux-cve-announce - CVE-2026-23032: null_blk: fix kmemleak by releasing references to fault configfs items

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <2026013121-CVE-2026-23032-643a@gregkh>
Date: Sat, 31 Jan 2026 12:44:32 +0100
From: Greg Kroah-Hartman <gregkh@...uxfoundation.org>
To: linux-cve-announce@...r.kernel.org
Cc: Greg Kroah-Hartman <gregkh@...nel.org>
Subject: CVE-2026-23032: null_blk: fix kmemleak by releasing references to fault configfs items

From: Greg Kroah-Hartman <gregkh@...nel.org>

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

null_blk: fix kmemleak by releasing references to fault configfs items

When CONFIG_BLK_DEV_NULL_BLK_FAULT_INJECTION is enabled, the null-blk
driver sets up fault injection support by creating the timeout_inject,
requeue_inject, and init_hctx_fault_inject configfs items as children
of the top-level nullbX configfs group.

However, when the nullbX device is removed, the references taken to
these fault-config configfs items are not released. As a result,
kmemleak reports a memory leak, for example:

unreferenced object 0xc00000021ff25c40 (size 32):
  comm "mkdir", pid 10665, jiffies 4322121578
  hex dump (first 32 bytes):
    69 6e 69 74 5f 68 63 74 78 5f 66 61 75 6c 74 5f  init_hctx_fault_
    69 6e 6a 65 63 74 00 88 00 00 00 00 00 00 00 00  inject..........
  backtrace (crc 1a018c86):
    __kmalloc_node_track_caller_noprof+0x494/0xbd8
    kvasprintf+0x74/0xf4
    config_item_set_name+0xf0/0x104
    config_group_init_type_name+0x48/0xfc
    fault_config_init+0x48/0xf0
    0xc0080000180559e4
    configfs_mkdir+0x304/0x814
    vfs_mkdir+0x49c/0x604
    do_mkdirat+0x314/0x3d0
    sys_mkdir+0xa0/0xd8
    system_call_exception+0x1b0/0x4f0
    system_call_vectored_common+0x15c/0x2ec

Fix this by explicitly releasing the references to the fault-config
configfs items when dropping the reference to the top-level nullbX
configfs group.

The Linux kernel CVE team has assigned CVE-2026-23032 to this issue.


Affected and fixed versions
===========================

	Issue introduced in 6.4 with commit bb4c19e030f45c5416f1eb4daa94fbaf7165e9ea and fixed in 6.6.122 with commit 1a3286edf4d48ce37f8982ff3c3b65159a5ecbb2
	Issue introduced in 6.4 with commit bb4c19e030f45c5416f1eb4daa94fbaf7165e9ea and fixed in 6.12.67 with commit d59ba448ccd595d5d65e197216cf781a87db2b28
	Issue introduced in 6.4 with commit bb4c19e030f45c5416f1eb4daa94fbaf7165e9ea and fixed in 6.18.7 with commit f1718da051282698aa8fa150bebb9724f6389fda
	Issue introduced in 6.4 with commit bb4c19e030f45c5416f1eb4daa94fbaf7165e9ea and fixed in 6.19-rc6 with commit 40b94ec7edbbb867c4e26a1a43d2b898f04b93c5

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2026-23032
will be updated if fixes are backported, please check that for the most
up to date information about this issue.


Affected files
==============

The file(s) affected by this issue are:
	drivers/block/null_blk/main.c


Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/1a3286edf4d48ce37f8982ff3c3b65159a5ecbb2
	https://git.kernel.org/stable/c/d59ba448ccd595d5d65e197216cf781a87db2b28
	https://git.kernel.org/stable/c/f1718da051282698aa8fa150bebb9724f6389fda
	https://git.kernel.org/stable/c/40b94ec7edbbb867c4e26a1a43d2b898f04b93c5