pnfs/blocklayout: Fix device leaks on parse failure (CVE-2026-90150) | HOL Guard CVE

Unknown severity · Source severity not reportedCVE-2026-90150

pnfs/blocklayout: Fix device leaks on parse failure

Answer in brief

CVE-2026-90150 records a Unknown severity vulnerability in pnfs/blocklayout: Fix device leaks on parse failure. The current sources do not mark it as known exploited. The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.

Analysis pending evidence review

HOL Guard separates source facts from reviewed analysis. See the methodology.

Published Sep 17, 2026Updated Sep 17, 2026Source checked Sep 17, 2026First seen by HOL Sep 17, 2026Material review Sep 17, 2026

Upstream Advisory

Key facts

Risk: Unknown severitySource severity not reported
Exploitation: Not marked as known exploited
Affected software: 2 mapped packages or products
Fix availability: Available

Why this deserves its current priority

A CVSS score is not reported in the current record. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.

Analysis status

Analysis pending evidence review

Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.

Affected scope and exposure questions

The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.

Mapped affected packages and fixed versions
Package	Affected range	Fixed version
Linux/Linuxgeneric	>=5c83746a0cf2831d4b59f5cf99ef5fbf138564e4 <8a2494964edac2a13e82441c2bf887548dc3be0b \|\| >=5c83746a0cf2831d4b59f5cf99ef5fbf138564e4 <1e1c36b206c659cf94c6755a1d821ed1babd32bc \|\| >=5c83746a0cf2831d4b59f5cf99ef5fbf138564e4 <23e4162405c456ce12c772d5882d306135e828ae \|\| >=5c83746a0cf2831d4b59f5cf99ef5fbf138564e4 <c056f817e4200fb18079d5052c273a22f191ff0a	8a2494964edac2a13e82441c2bf887548dc3be0b, 1e1c36b206c659cf94c6755a1d821ed1babd32bc, 23e4162405c456ce12c772d5882d306135e828ae, c056f817e4200fb18079d5052c273a22f191ff0a
Linux/Linuxgeneric	3.18	Not reported

Recommended response

Check inventory. Check lockfiles and deployed manifests for Linux/Linux, Linux/Linux.
Review the reported fix. Update Linux/Linux to 8a2494964edac2a13e82441c2bf887548dc3be0b if you use the affected versions. Test the change in a non-production environment first.

Evidence timeline and material changes

Published upstream
Sep 17, 2026
Evidence: source:cvelist:source_dates:source-dates:record
Source modified
Sep 17, 2026
Evidence: source:cvelist:source_dates:source-dates:record
First seen by HOL
Sep 17, 2026

Sources and claim methodology

Upstream source description

In the Linux kernel, the following vulnerability has been resolved: pnfs/blocklayout: Fix device leaks on parse failure bl_parse_concat() and bl_parse_stripe() allocate a child device array and then parse each child in turn. If parsing a child fails, the failed child is not counted in nr_children and the parent may be left with a children array that bl_free_device() will not release when nr_children is zero. Release the failed child and the already parsed children before returning the error. Also make bl_free_device() release the child array whenever the children pointer is set, so that partially initialised concat or stripe devices are cleaned up correctly. bl_parse_scsi() can also fail after assigning d->bdev_file and dropping the file reference. Clear the pointer after fput() so that an outer cleanup path does not put it again.

Quoted source text, attributed separately from HOL analysis.