CVE-2026-23032 — Missing Release of Resource after Effective Lifetime in Linux
Severity
4.4MEDIUM
No vectorEPSS
0.0%
top 98.66%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
Timeline
PublishedJan 31
Description
In the Linux kernel, the following vulnerability has been resolved:
null_blk: fix kmemleak by releasing references to fault configfs items
When CONFIG_BLK_DEV_NULL_BLK_FAULT_INJECTION is enabled, the null-blk
driver sets up fault injection support by creating the timeout_inject,
requeue_inject, and init_hctx_fault_inject configfs items as children
of the top-level nullbX configfs group.
However, when the nullbX device is removed, the references taken to
these fault-config configfs items are n…
Affected Packages4 packages
▶CVEListV5linux/linuxbb4c19e030f45c5416f1eb4daa94fbaf7165e9ea — 1a3286edf4d48ce37f8982ff3c3b65159a5ecbb2+4
🔴Vulnerability Details
3GHSA▶
GHSA-jq2q-j87r-jrqv: In the Linux kernel, the following vulnerability has been resolved:
null_blk: fix kmemleak by releasing references to fault configfs items
When CONF↗2026-01-31
OSV▶
CVE-2026-23032: In the Linux kernel, the following vulnerability has been resolved: null_blk: fix kmemleak by releasing references to fault configfs items When CONFIG↗2026-01-31