Executive brief
A vulnerability was identified in the Linux kernel's block control group (blk-cgroup) subsystem, which manages disk I/O resources. A race condition during the cleanup of internal data structures could allow a 'use-after-free' error, potentially leading to a system crash or unpredictable behavior. This issue occurs when multiple resource groups are released at the same time.
Technical details
A use-after-free (UAF) vulnerability exists in the __blkcg_rstat_flush() function within the Linux kernel's block cgroup implementation. The flaw is rooted in a race condition where one block group (blkg) flushing statistics removes iostat entries of another blkg via llist_del_all(). If the second blkg concurrently proceeds with its release process, it may free itself while the first is still iterating over its entries. The fix involves moving the flush operation from the RCU callback (__blkg_release) to the initial release phase (blkg_release), ensuring the RCU grace period protects the data during concurrent flushes.
Affected products
- Linux Linux Kernel 6.4 to 6.6.143, 6.12.94, 6.18.37, 7.1.2
Timeline
- 2026-07-19: advisory: CVE published by NVD
- 2026-07-19: patched: Fixes merged into stable kernel branches
References
- https://git.kernel.org/stable/c/0ab5ee5a1badb58cbb2242617cb01a4972b1f2a2
- https://git.kernel.org/stable/c/5e5b7f2ef854936e95dceb6a2fdfefcb7152d2c6
- https://git.kernel.org/stable/c/96e545410c4f74c89d496c1d5d9ef8d08f14368b
- https://git.kernel.org/stable/c/afebe44facc48a61761e885bbb7f0380d4a603ec
- https://git.kernel.org/stable/c/bbebd9425cad3573d1527441753899b926525a0f