Executive brief
A vulnerability was identified in the Linux kernel's block control group (blk-cgroup) subsystem, which manages disk I/O resources. A logic error in how the kernel handles disk references during certain error conditions can lead to a resource leak. Over time, this could prevent storage disks from being properly decommissioned or freed by the system, potentially impacting long-term system stability.
Technical details
A reference counting vulnerability exists in block/blk-cgroup.c within the blkcg_maybe_throttle_current() function. When a lookup for blkcg, blkg, or a blkg_tryget() operation fails, the code jumps to an error label that fails to call put_disk(). This oversight leaves an active reference on the gendisk structure acquired via get_device() in blkcg_schedule_throttle(). Because the task's throttle_disk pointer is cleared before the lookup, the reference cannot be recovered during task exit, leading to a permanent leak of the disk object. The issue was introduced during the transition from request_queue to gendisk structures. Patches have been merged into multiple stable kernel branches to ensure put_disk() is called on the error path.
Affected products
- Linux Linux kernel
Timeline
- 2026-03-31: disclosed: Initial patch submission by Jackie Liu
- 2026-05-23: patched: Patch committed to stable trees
- 2026-06-24: advisory: NVD publication date
References
- https://git.kernel.org/stable/c/000e8454692cab9d1f1b80130e2870e355301d06
- https://git.kernel.org/stable/c/23308af722fefed00af5f238024c11710938fba3
- https://git.kernel.org/stable/c/4048ed98860d3785645ebbd34f69566a6c7320c3
- https://git.kernel.org/stable/c/73a5af059905d171b398c8b2381632ee499948b5
- https://git.kernel.org/stable/c/b3e005f16cd98f815429a87aef4c61e9c140779f