CVE-2026-23032

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

null_blk: fix kmemleak by releasing references to fault configfs items

When CONFIG_BLK_DEV_NULL_BLK_FAULT_INJECTION is enabled, the null-blk

driver sets up fault injection support by creating the timeout_inject,

requeue_inject, and init_hctx_fault_inject configfs items as children

of the top-level nullbX configfs group.

However, when the nullbX device is removed, the references taken to

these fault-config configfs items are not released. As a result,

kmemleak reports a memory leak, for example:

unreferenced object 0xc00000021ff25c40 (size 32):

comm "mkdir", pid 10665, jiffies 4322121578

hex dump (first 32 bytes):

69 6e 69 74 5f 68 63 74 78 5f 66 61 75 6c 74 5f init_hctx_fault_

69 6e 6a 65 63 74 00 88 00 00 00 00 00 00 00 00 inject..........

backtrace (crc 1a018c86):

__kmalloc_node_track_caller_noprof+0x494/0xbd8

kvasprintf+0x74/0xf4

config_item_set_name+0xf0/0x104

config_group_init_t

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References