Device Leak Vulnerability in Linux Kernel: Impacting Debian Packages
Summary
DEBIAN-CVE-2026-90150: In the Linux kernel, the following vulnerability has been resolved: pnfs/blocklayout: Fix device leaks on parse failure bl_parse_concat() and bl_parse_stripe() allocate a child device array and then parse each child in t... Affects linux versions 6.1.106-1 – 7.2~rc7-1~exp1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is the core component of the Debian operating system, responsible for managing hardware resources and providing essential services to software applications. It is a critical part of system functionality, ensuring efficient communication between hardware and software. This vulnerability affects multiple Debian distributions, including Bookworm, Trixie, and Forky, highlighting the importance of maintaining kernel integrity for system security.
Vulnerability Detail
In the Linux kernel, a vulnerability has been identified in the pnfs/blocklayout module, specifically in the bl_parse_concat() and bl_parse_stripe() functions. These functions allocate an array for child devices and attempt to parse each child. If a parsing error occurs, the failed child is not accounted for in the number of children, potentially leaving the parent with an unmanageable array. This can lead to memory leaks, as the bl_free_device() function may not release the array when no children are present. Additionally, bl_parse_scsi() can fail after assigning a device file, necessitating careful pointer management to avoid further issues. The ramifications of this vulnerability include potential system instability and resource exhaustion.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
Currently, there are no specific workarounds mentioned for this vulnerability. However, users are advised to monitor their systems for any unusual behavior and apply the patch as soon as it becomes available.
Conclusion
The identified vulnerability in the Linux kernel's pnfs/blocklayout module poses significant risks to Debian systems, including potential memory leaks and resource exhaustion. It is crucial for users to update their systems promptly to mitigate these risks and ensure ongoing security. Utilizing tools like Vulert can further enhance vulnerability management.
See every vulnerability recorded for linux →
FAQ
The vulnerability involves memory leaks in the Linux kernel's pnfs/blocklayout module, which can lead to resource exhaustion.
The vulnerability affects Debian 12 (Bookworm), Debian 13 (Trixie), and Debian 14 (Forky).
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected without requiring any signup.
While there are no specific workarounds, it is crucial to monitor your system for any unusual behavior and plan to apply the patch as soon as possible.
Vulert uses a manifest file like package-lock.json to monitor and alert in real-time for open-source vulnerabilities in your software, making it easier to maintain security.
References
Related vulnerabilities
Recent vulnerabilities recorded for linux.
