{"id":"CVE-2026-90325","revision":"822b1d574cde4c9ead8131f291321896","records":[{"revision":"822b1d574cde4c9ead8131f291321896","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-90325","aliases":[],"title":"blk-cgroup: skip dying blkg in blkcg_activate_policy()","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nblk-cgroup: skip dying blkg in blkcg_activate_policy()\n\nWhen switching IO schedulers on a block device, blkcg_activate_policy()\ncan race with concurrent blkcg deletion, leading to a use-after-free in\nrcu_accelerate_cbs.\n\nT1:                               T2:\n                                  blkg_destroy\n                                  kill(&blkg->refcnt) // blkg->refcnt=1->0\n                                  blkg_release // call_rcu(__blkg_release)\n                                  ...\n                                  blkg_free_workfn\n                                  ->pd_free_fn(pd)\nelv_iosched_store\nelevator_switch\n...\niterate blkg list\nblkg_get(blkg) // blkg->refcnt=0->1\n                                  list_del_init(&blkg->q_node)\nblkg_put(pinned_blkg) // blkg->refcnt=1->0\nblkg_release // call_rcu again\nrcu_accelerate_cbs // uaf\n\nFix this by checking hlist_unhashed(&blkg->blkcg_node) before getting\na reference to the blkg. This is the same check used in blkg_destroy()\nto detect if a blkg has already been destroyed. If the blkg is already\nunhashed, skip processing it since it's being destroyed.","state":0,"publishedAt":"2026-09-17T16:08:40.71+00:00","modifiedAt":"2026-10-19T09:01:42.317+00:00","affected":[{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"unaffected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"block/blk-cgroup.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"81c1188905f88b77743d1fdeeedfc8cb7b67787d\",\n                            \"lessThan\": \"b5dae1cd0d8368b4338430ff93403df67f0b8bcc\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"bfe46d2efe46c5c952f982e2ca94fe2ec5e58e2a\",\n                            \"lessThan\": \"083b58373463a6e5ee60ecb135269348f68ad7df\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"f1c006f1c6850c14040f8337753a63119bba39b9\",\n                            \"lessThan\": \"1a267295b1ea6a6477963f3fda84adfecd48fcad\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"f1c006f1c6850c14040f8337753a63119bba39b9\",\n                            \"lessThan\": \"7337d012ca3fc3a6a2d1c8e2a19c6d97c38b410d\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"f1c006f1c6850c14040f8337753a63119bba39b9\",\n                            \"lessThan\": \"3d8c3da95c75a4d312e272fc7b4076dd3ba9115c\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"f1c006f1c6850c14040f8337753a63119bba39b9\",\n                            \"lessThan\": \"d8c872901e6459339374e9eea80aa919176c2ccd\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"f1c006f1c6850c14040f8337753a63119bba39b9\",\n                            \"lessThan\": \"5e9220389920f33b6a804d50c548cd0cd1b04634\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"6.1.16\",\n                            \"lessThan\": \"6.1.17\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.2.3\",\n                            \"lessThan\": \"6.2.4\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"semver\"\n                        }\n                    ]\n                }"},{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"affected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"block/blk-cgroup.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"6.3\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"0\",\n                            \"lessThan\": \"6.3\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.1.17\",\n                            \"lessThanOrEqual\": \"6.1.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.2.4\",\n                            \"lessThanOrEqual\": \"6.2.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.6.157\",\n                            \"lessThanOrEqual\": \"6.6.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.12.110\",\n                            \"lessThanOrEqual\": \"6.12.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.18.52\",\n                            \"lessThanOrEqual\": \"6.18.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"7.2.6\",\n                            \"lessThanOrEqual\": \"7.2.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"7.3\",\n                            \"lessThanOrEqual\": \"*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"original_commit_for_fix\"\n                        }\n                    ]\n                }"}],"metrics":[{"system":"CVSS 3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","score":7.8,"severity":"HIGH"}],"references":["https://git.kernel.org/stable/c/b5dae1cd0d8368b4338430ff93403df67f0b8bcc","https://git.kernel.org/stable/c/083b58373463a6e5ee60ecb135269348f68ad7df","https://git.kernel.org/stable/c/1a267295b1ea6a6477963f3fda84adfecd48fcad","https://git.kernel.org/stable/c/7337d012ca3fc3a6a2d1c8e2a19c6d97c38b410d","https://git.kernel.org/stable/c/3d8c3da95c75a4d312e272fc7b4076dd3ba9115c","https://git.kernel.org/stable/c/d8c872901e6459339374e9eea80aa919176c2ccd","https://git.kernel.org/stable/c/5e9220389920f33b6a804d50c548cd0cd1b04634"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-90325","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-90325","identifiers":["CVE-2026-90325"]},"retained":false,"historicalAffected":[]}],"coverage":[]}