Executive brief
A vulnerability in the Linux kernel's bcache component can cause a system crash or potential data corruption. bcache is a mechanism used to speed up hard drives by using faster SSDs as a cache. If a cached device is stopped while a background write operation is still in progress, the system may attempt to access memory that has already been freed, leading to instability.
Technical details
A use-after-free vulnerability exists in the Linux kernel bcache driver within the cached_dev_free function. The root cause is a race condition where the 'sb_bio' structure, which is embedded within 'struct cached_dev', is accessed after the parent structure has been freed. This occurs if a device is stopped while a superblock write ('sb_write') is still in progress; the 'endio' callback subsequently attempts to access the now-released memory address. The fix involves adding a 'closure_sync' call in 'cached_dev_free' to ensure all pending superblock writes are completed before the memory is reclaimed. This issue primarily affects systems using bcache for block-layer caching.
Affected products
- Linux Linux Kernel versions up to 6.6.136, 6.12.83, 6.13 to 6.18.24, 6.19 to 6.19.14, 7.0 to 7.0.1
Timeline
- 2026-04-24: disclosed
- 2026-04-24: advisory
- 2026-04-22: patched: Initial patches committed to stable trees.
References
- https://git.kernel.org/stable/c/2d6965581e164fa2ba3f7652ddae5535f6336576
- https://git.kernel.org/stable/c/383f7fec0de8cee1cf7ae1f9d9f14044a61f10f9
- https://git.kernel.org/stable/c/47fa09fe7f3e09df28a51cb2cbd8f5d2f7f6edc1
- https://git.kernel.org/stable/c/4f71c8ba2dc009042493021d94a9718fbe2ebf27
- https://git.kernel.org/stable/c/81f44ed8c3f54abb7561ece774ea4cca5070b2f2
- https://git.kernel.org/stable/c/9467d360be70e6ee55b0c1cd2a1f1424f57b5b85
- https://git.kernel.org/stable/c/add4982510f3b7c318a2dd7438bdc9c63171e753