CVE-2026-90187

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description A memory leak occurs in the null blk driver when a zoned device is powered off and on repeatedly. The null init zoned dev() function allocates the dev->zones array during power-on, but null del dev() fails to free this array during power-off. Consequently, each power cycle overwrites the dev->zones pointer with a new allocation, leaking the previous memory. Additionally, a race condition exists where zone cond store() lacks proper serialization with the allocation and freeing of dev->zones via the &lock mechanism.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.