CVE-2026-23032
BaseFortify
Publication date: 2026-01-31
Last updated on: 2026-02-03
Assigner: kernel.org
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| linux | linux_kernel | * |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-UNKNOWN |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability occurs in the Linux kernel's null-blk driver when the CONFIG_BLK_DEV_NULL_BLK_FAULT_INJECTION option is enabled. The driver creates certain fault injection configfs items as children of a top-level nullbX configfs group. However, when the nullbX device is removed, the references to these fault-config configfs items are not properly released, causing a memory leak detected by kmemleak. The issue is fixed by explicitly releasing these references when the top-level nullbX configfs group reference is dropped.
How can this vulnerability impact me? :
The vulnerability can lead to memory leaks in the Linux kernel when the null-blk fault injection feature is used. This could potentially degrade system performance or stability over time due to unreleased memory resources.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by monitoring kmemleak reports for memory leaks related to the null_blk driver fault injection configfs items. Specifically, look for unreferenced objects associated with fault configfs items such as timeout_inject, requeue_inject, and init_hctx_fault_inject under nullbX devices. Commands to check kmemleak logs include: `dmesg | grep kmemleak` or checking the kmemleak debugfs interface with `cat /sys/kernel/debug/kmemleak`.
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation involves ensuring that the Linux kernel is updated to a version where this vulnerability is fixed, which includes the explicit release of references to fault-config configfs items when nullbX devices are removed. If updating is not immediately possible, avoid enabling CONFIG_BLK_DEV_NULL_BLK_FAULT_INJECTION or remove nullbX devices carefully to minimize memory leaks.