CVE-2026-23032: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-23032 is a memory leak vulnerability in the Linux kernel's null-blk driver that can lead to denial of service through kernel memory exhaustion. When CONFIG_BLK_DEV_NULL_BLK_FAULT_INJECTION is enabled, the driver creates configfs items (timeout_inject, requeue_inject, and init_hctx_fault_inject) for fault injection support, but fails to release references to these items when a null-blk device is removed. The vulnerability was published on January 31, 2026, and affects Linux kernel versions from commit bb4c19e030f4 onward until the respective fixes. It carries a CVSS v3.1 base score of 5.5 (Medium) (Red Hat CVE, Red Hat Bugzilla).

The root cause is a missing reference release (CWE-401: Missing Release of Memory after Effective Lifetime) in the null-blk driver's device teardown path. When a nullbX device is removed, the driver drops the reference to the top-level configfs group but neglects to call the corresponding release functions for the child fault-config configfs items (timeout_inject, requeue_inject, init_hctx_fault_inject). This results in kernel memory allocated during fault_config_init() — specifically via config_group_init_type_name() and config_item_set_name() — never being freed, which kmemleak detects as an unreferenced object. Exploitation requires local access with low privileges (e.g., the ability to create and remove null-blk devices via configfs mkdir/rmdir operations) (Red Hat Bugzilla, Feedly).

Successful exploitation allows a local attacker with low privileges to repeatedly create and remove null-blk devices, causing unreleased kernel memory to accumulate over time. This can exhaust available kernel memory, leading to system instability or crashes — a denial of service condition. There is no confidentiality or integrity impact; the vulnerability is limited to availability (Red Hat CVE, Feedly).

Patches are available in upstream Linux kernel commits 1a3286edf4d4, d59ba448ccd5, f1718da05128, and 40b94ec7edbb. Fixed kernel versions include 6.6.122, 6.12.67, 6.18.7, and 6.19-rc6 or later. Ubuntu has issued security notices USN-8278-1, USN-8278-2, USN-8289-1, USN-8289-2, and USN-8296-1/USN-8296-2 addressing this issue. As a workaround where immediate patching is not feasible, disable the CONFIG_BLK_DEV_NULL_BLK_FAULT_INJECTION kernel configuration option at compile time if fault injection functionality is not required, and monitor systems for signs of kernel memory exhaustion (Red Hat Bugzilla, Ubuntu USN-8278-1).