Executive brief
The Linux kernel's I/O latency controller has a bug where delay state is not properly cleared when policy data is freed, leaving internal counters elevated indefinitely. This causes subsequent I/O operations in the affected cgroup to be artificially throttled for the lifetime of the cgroup, degrading performance for legitimate workloads including file caching and memory swapping.
Technical details
The io.latency block I/O controller (blk-iolatency) in the Linux kernel has a memory leak in its cgroup policy cleanup. When a cgroup is throttled as collateral damage (having no latency target of its own but being scaled down when a sibling misses its latency SLO), the iolatency_pd_offline() function fails to clear the delay state if min_lat_nsec equals zero. When the policy data is freed later via iolatency_pd_free(), the blkg->use_delay flag and blkcg->congestion_count remain elevated with no mechanism to reset them. Subsequent calls to blk_cgroup_congested() then permanently return true for all tasks in that cgroup and descendants, causing page readahead to be limited to single pages and anonymous memory allocations to be artificially throttled. The fix adds an explicit blkcg_clear_delay() call in iolatency_pd_free() to drop these orphaned delay flags before RCU cleanup, guarded by a blkg pointer check to handle policy data never attached to any block group.
Affected products
- Linux Linux Kernel affected in multiple versions through 6.9; fixed in stable releases via upstream commit 8935bf22c0a0db517a7f72f7097300e05dd852f5
Timeline
- 2026-09-17: disclosed: CVE-2026-90183 published on NVD
- 2026-08-14: patched: Upstream fix committed by Usama Arif
- 2026-09-14: patched: Fix merged to stable kernel releases