Executive brief
The Linux kernel's block I/O cgroup subsystem contains a race condition during IO scheduler switching that can lead to use-after-free memory corruption and kernel crashes. When changing IO schedulers on a block device, the kernel may access memory that has already been freed if a cgroup is deleted concurrently, potentially allowing a local attacker to cause denial of service or kernel instability.
Technical details
The vulnerability is a use-after-free race condition in blkcg_activate_policy() within the block I/O cgroup subsystem. When allocating policy data structures (blkg_policy_data) for attached block groups during IO scheduler activation, a memory allocation failure triggers a rollback path that accesses freed memory if a cgroup is concurrently destroyed. Additionally, blkg_free_workfn() frees policy data before removing the block group from the queue list, allowing new allocations for structures already marked for destruction. The attack vector requires local access and involves racing IO scheduler changes against cgroup deletion. The fix extends mutex (blkcg_mutex) coverage to serialize policy activation rollback and block group destruction, ensuring proper synchronization of data structure lifecycles. Patches are available in the Linux kernel stable tree.
Affected products
- Linux Linux kernel multiple versions across 3.x through 6.x and 7.x series
Timeline
- 2026-09-17: disclosed: CVE-2026-90326 published
- 2026-09-14: patched: Fix commit 2cf9f50a38c1839e549a08e22aa35e8d69e2c8fd merged to stable tree
- 2023-03-11: other: Partial fix (commit 083b58373463a6e5ee60ecb135269348f68ad7df) reverted due to incomplete patch series