CVE-2026-90325
Description
In the Linux kernel, the following vulnerability has been resolved: blk-cgroup: skip dying blkg in blkcg_activate_policy() When switching IO schedulers on a block device, blkcg_activate_policy() can race with concurrent blkcg deletion, leading to a use-after-free in rcu_accelerate_cbs. T1: T2: blkg_destroy kill(&blkg->refcnt) // blkg->refcnt=1->0 blkg_release // call_rcu(__blkg_release) ... blkg_free_workfn ->pd_free_fn(pd) elv_iosched_store elevator_switch ... iterate blkg list blkg_get(blkg) // blkg->refcnt=0->1 list_del_init(&blkg->q_node) blkg_put(pinned_blkg) // blkg->refcnt=1->0 blkg_release // call_rcu again rcu_accelerate_cbs // uaf Fix this by checking hlist_unhashed(&blkg->blkcg_node) before getting a reference to the blkg. This is the same check used in blkg_destroy() to detect if a blkg has already been destroyed. If the blkg is already unhashed, skip processing it since it's being destroyed.
How to fix
- Linux Linuxb5dae1cd0d8368b4338430ff93403df67f0b8bcc, 083b58373463a6e5ee60ecb135269348f68ad7df, 1a267295b1ea6a6477963f3fda84adfecd48fcad, 7337d012ca3fc3a6a2d1c8e2a19c6d97c38b410d, 3d8c3da95c75a4d312e272fc7b4076dd3ba9115c, d8c872901e6459339374e9eea80aa919176c2ccd, 5e9220389920f33b6a804d50c548cd0cd1b04634, 6.1.17, 6.2.4 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| Linux Linux | 81c1188905f88b77743d1fdeeedfc8cb7b67787d ≤ v < b5dae1cd0d8368b4338430ff93403df67f0b8bcc, bfe46d2efe46c5c952f982e2ca94fe2ec5e58e2a ≤ v < 083b58373463a6e5ee60ecb135269348f68ad7df, f1c006f1c6850c14040f8337753a63119bba39b9 ≤ v < 1a267295b1ea6a6477963f3fda84adfecd48fcad, f1c006f1c6850c14040f8337753a63119bba39b9 ≤ v < 7337d012ca3fc3a6a2d1c8e2a19c6d97c38b410d, f1c006f1c6850c14040f8337753a63119bba39b9 ≤ v < 3d8c3da95c75a4d312e272fc7b4076dd3ba9115c, f1c006f1c6850c14040f8337753a63119bba39b9 ≤ v < d8c872901e6459339374e9eea80aa919176c2ccd, f1c006f1c6850c14040f8337753a63119bba39b9 ≤ v < 5e9220389920f33b6a804d50c548cd0cd1b04634, 6.1.16 ≤ v < 6.1.17, 6.2.3 ≤ v < 6.2.4, 6.3 | b5dae1cd0d8368b4338430ff93403df67f0b8bcc, 083b58373463a6e5ee60ecb135269348f68ad7df, 1a267295b1ea6a6477963f3fda84adfecd48fcad, 7337d012ca3fc3a6a2d1c8e2a19c6d97c38b410d, 3d8c3da95c75a4d312e272fc7b4076dd3ba9115c, d8c872901e6459339374e9eea80aa919176c2ccd, 5e9220389920f33b6a804d50c548cd0cd1b04634, 6.1.17, 6.2.4 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.