CVE-2026-31586: mm: blk-cgroup: fix use-after-free in cgwb_release_workfn()
In the Linux kernel, the following vulnerability has been resolved:
mm: blk-cgroup: fix use-after-free in cgwbreleaseworkfn()
cgwbreleaseworkfn() calls cssput(wb->blkcgcss) and then later accesses wb->blkcgcss again via blkcgunpinonline(). If cssput() drops the last reference, the blkcg can be freed asynchronously (cssfreerworkfn -> blkcgcssfree -> kfree) before blkcgunpinonline() dereferences the pointer to access blkcg->onlinepin, resulting in a use-after-free:
BUG: KASAN: slab-use-after-free in blkcgunpinonline (./include/linux/instrumented.h:112 ./include/linux/atomic/atomic-instrumented.h:400 ./include/linux/refcount.h:389 ./include/linux/refcount.h:432 ./include/linux/refcount.h:450 block/blk-cgroup.c:1367) Write of size 4 at addr ff11000117aa6160 by task kworker/71:1/531 Workqueue: cgwbrelease cgwbreleaseworkfn Call Trace: <TASK> blkcgunpinonline (./include/linux/instrumented.h:112 ./include/linux/atomic/atomic-instrumented.h:400 ./include/linux/refcount.h:389 ./include/linux/refcount.h:432 ./include/linux/refcount.h:450 block/blk-cgroup.c:1367) cgwbreleaseworkfn (mm/backing-dev.c:629) processscheduledworks (kernel/workqueue.c:3278 kernel/workqueue.c:3385)
Freed by task 1016: kfree (./include/linux/kasan.h:235 mm/slub.c:2689 mm/slub.c:6246 mm/slub.c:6561) cssfreerworkfn (kernel/cgroup/cgroup.c:5542) processscheduledworks (kernel/workqueue.c:3302 kernel/workqueue.c:3385)
Stack based on commit 66672af7a095 ("Add linux-next specific files for 20260410")
I am seeing this crash sporadically in Meta fleet across multiple kernel versions. A full reproducer is available at: https://github.com/leitao/debug/blob/main/reproducers/reproblkcguaf.sh
(The race window is narrow. To make it easily reproducible, inject a msleep(100) between cssput() and blkcgunpinonline() in cgwbreleaseworkfn(). With that delay and a KASAN-enabled kernel, the reproducer triggers the splat reliably in less than a second.)
Fix this by moving blkcgunpinonline() before cssput(), so the cgwb's CSS reference keeps the blkcg alive while blkcgunpinonline() accesses it.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 6.6.137.1-1 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.1.176-1Fixed in 6.1.190-1Fixed in 6.12.107-1Fixed in 6.12.115-2Fixed in 7.2.12-1Fixed in 7.2.15-1 - Compensating control
In the Linux kernel's cgwb_release_workfn(), move blkcg_unpin_online() before css_put() so the cgwb's CSS reference keeps the blkcg alive while blkcg_unpin_online() accesses it.
Event History
Frequently Asked Questions
What level of access is needed to exploit this issue?
The CVSS vector indicates local access with low privileges is required, and no user interaction is needed. The recorded impact includes low confidentiality and integrity impact and high availability impact.
Which systems are identified as affected?
The affected software list includes the Linux kernel blk-cgroup component and Microsoft azl3 kernel 6.6.134.1-2. No broader affected-version range is provided.
How might an existing occurrence appear in logs or diagnostics?
The provided report shows a KASAN slab-use-after-free in blkcg_unpin_online, triggered from cgwb_release_workfn on the cgwb_release workqueue. It may be reported by a kworker task and include a write-of-size-4 use-after-free trace.
Is there an upstream fix reference available?
The vulnerability is described as resolved, and two Linux stable Git commit references are provided: 23acef4156c260e8598397a1a2e8b3a23e919893 and 1bd36e93b542d9dd020190c6607c6a3663405195. The data does not provide the kernel release versions containing those fixes.