CVE-2026-64017: blk-mq: pop cached request if it is usable
blk-mq: pop cached request if it is usable
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.12.107-1Fixed in 6.12.113-1Fixed in 7.2.12-1Fixed in 7.2.13-1 - Upgrade
Upgrade
debian/linux-6.12to a version that resolves this vulnerability.Fixed in 6.12.113-1~deb12u1 - Compensating control
In Linux kernel blk-mq, pop the cached request before any possible blocking calls when it is suitable for use, so it retains a queue reference and is not freed by blk_mq_free_plug_rqs.
Event History
Frequently Asked Questions
What is CVE-2026-64017?
CVE-2026-64017 is a vulnerability in the Linux kernel related to improper handling of cached requests in the blk-mq subsystem.
What is the severity of CVE-2026-64017?
The severity of CVE-2026-64017 is rated at 47, indicating a moderate risk level.
How do I fix CVE-2026-64017?
To fix CVE-2026-64017, update to the latest version of the Linux kernel that includes the patch for this vulnerability.
What systems are affected by CVE-2026-64017?
CVE-2026-64017 affects various systems running vulnerable versions of the Linux kernel with blk-mq functionality.
What type of vulnerability is CVE-2026-64017?
CVE-2026-64017 is classified as a Use After Free vulnerability.