CVE-2026-63802: blk-cgroup: fix UAF in __blkcg_rstat_flush()
blk-cgroup: fix UAF in blkcgrstatflush()
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 6.6.150.1-1
Event History
Frequently Asked Questions
What conditions are required to trigger the use-after-free?
Multiple block group objects (blkgs) in the same block cgroup must be released concurrently. The race occurs when one release flushes and removes another blkg's iostat entries while the other release observes an empty list and frees itself.
What level of access does an attacker need?
The CVSS vector indicates local access and low privileges are required, with no user interaction. The provided data does not describe a specific exploitation path beyond triggering the concurrent blkg-release race.
How was the issue fixed?
The flush operation was moved from __blkg_release(), which runs as an RCU callback, to blkg_release(), before call_rcu(). This makes the RCU grace period wait for concurrent flush operations holding rcu_read_lock() before the blkg can be freed.
Which listed software is affected?
The affected software list includes Linux kernel, Linux Kernel, and Microsoft azl3 kernel 6.6.143.1-1.