CVE-2026-90326

CVE CVE-2026-90326EUVD EUVD-2026-81987Published 2026-09-17T16:08:41.000ZLast changed 2026-09-18T17:54:39.000ZCVSS 7.8

What the advisory describes

In the Linux kernel, the following vulnerability has been resolved: blk-cgroup: fix race between policy activation and blkg destruction When switching an IO scheduler on a block device, blkcg_activate_policy() allocates blkg_policy_data (pd) for all blkgs attached to the queue. However, blkcg_activate_policy() may race with concurrent blkcg deletion, leading to use-after-free and memory leak issues. The use-after-free occurs in the following race: T1 (blkcg_activate_policy): - Successfully allocates pd for blkg1 (loop0->queue, blkcgA) - Fails to allocate pd for blkg2 (loop0->queue, blkcgB) - Enters the enomem rollback path to release blkg1 resources T2 (blkcg deletion): - blkcgA is deleted concurrently - blkg1 is freed via blkg_free_workfn() - blkg1->pd is freed T1 (continued): - Rollback path accesses blkg1->pd->online after pd is freed - Triggers use-after-free In addition, blkg_free_workfn() frees pd before removing the blkg from q->blkg_list. This allows blkcg_activate_policy() to allocate a new pd for a blkg that is being destroyed, leaving the newly allocated pd unreachable when the blkg is finally freed. Fix these races by extending blkcg_mutex coverage to serialize blkcg_activate_policy() rollback and blkg destruction, ensuring pd lifecycle is synchronized with blkg list visibility.

Source: EUVD (ENISA), in the words of the advisory.

Products the advisory names

These come from the advisory itself, not from any check we performed.

Linux — Linux patch: 7.3-rc1; f1c006f1c6850c14040f8337753a63119bba39b9 <2cf9f50a38c1839e549a08e22aa35e8d69e2c8fd; bfe46d2efe46c5c952f982e2ca94fe2ec5e58e2a <083b58373463a6e5ee60ecb135269348f68ad7df; 81c1188905f88b77743d1fdeeedfc8cb7b67787d <b5dae1cd0d8368b4338430ff93403df67f0b8bcc; patch: 0; 6.2.3 <6.2.4; f1c006f1c6850c14040f8337753a63119bba39b9 <5313d4d41739b0cb63000747c97bb1217ac45f3e; patch: 6.18.52; patch: 7.2.6; patch: 6.1.17; 6.3; f1c006f1c6850c14040f8337753a63119bba39b9 <ac34e655dffa74349d885a43d098115336f53842; patch: 6.2.4; 6.1.16 <6.1.17

The versions shown are the advisory's own. Patchlage compares no version numbers and derives no judgement from them — which version is installed is something a person has to look up.

Carried in the product catalogue

An estate covering these products can be recorded in Patchlage. An advisory about them appears in the next morning's situation report.

Linux — Linux

Does this concern one of your customers?

This page cannot answer that — it does not know your estate. Whoever has recorded their environments gets the answer the morning after publication, together with a paragraph they can forward to the customer unedited.

Try it for 28 days

Patchlage reports hits and suspected hits. About everything else this system says nothing — neither this page nor the situation report ever claims that an estate is safe.