CVE-2026-64017

CVE CVE-2026-64017EUVD EUVD-2026-45590Published 2026-07-19T15:39:11.000ZLast changed 2026-08-05T12:38:14.000ZCVSS 7.8

What the advisory describes

In the Linux kernel, the following vulnerability has been resolved: blk-mq: pop cached request if it is usable When submitting a bio to blk-mq, if the task should sleep after peeking a cached request, but before it pops it, the plug flushes and calls blk_mq_free_plug_rqs, freeing the cached_rqs. This creates a use-after-free bug. Fix this by popping the cached request before any possible blocking calls if it is suitable for use. Popping this request first holds a queue reference, so avoid any serialization races with queue freezes and can safely proceed with dispatching that request to the driver. This potentially increases a timing window from when a driver wants to freeze its queue to when requests stop being dispatched. That scenario is off the fast path though, and drivers need to appropriately handle requests during a freeze request anyway. The downside is the popped element needs to be individually freed when we performed a bio plug merge. The cached request would have had to be freed later anyway, but this patch does it inline with building the plug list instead of after flushing it.

Source: EUVD (ENISA), in the words of the advisory.

Products the advisory names

These come from the advisory itself, not from any check we performed.

Linux — Linux b5c8e0ff76d10f6bf70a7237678f27c20cf59bc9; 6.6.3 <6.7; patch: 0; 8b6075046470c8756242dfe3fd058813636f69a3; patch: 7.1; 33cf52b6e53a6aa55883aa7fb9ceffceff8488a6; 6.7; 6.5.13 <6.6; 6.6.14 <6.7; 6.1.75 <6.2; patch: 7.0.11; b0077e269f6c152e807fdac90b58caf012cdbaab <388468f7e7d1eab092cf2a39fdfb502e52019ec6; b80056bd75a16e4550873ecefe12bc8fd190b1cf; e9c309ded295b7f8849097d71ae231456ca79f78; 6.1.72 <6.2; b0077e269f6c152e807fdac90b58caf012cdbaab <dc278e9bf2b9513a763353e6b9cc21e0f532954e

The versions shown are the advisory's own. Patchlage compares no version numbers and derives no judgement from them — which version is installed is something a person has to look up.

Carried in the product catalogue

An estate covering these products can be recorded in Patchlage. An advisory about them appears in the next morning's situation report.

Linux — Linux

Does this concern one of your customers?

This page cannot answer that — it does not know your estate. Whoever has recorded their environments gets the answer the morning after publication, together with a paragraph they can forward to the customer unedited.

Try it for 28 days

Patchlage reports hits and suspected hits. About everything else this system says nothing — neither this page nor the situation report ever claims that an estate is safe.