CVE-2026-64509: rust: block: fix GenDisk cleanup paths

Published Jul 25, 2026
·
Updated

In the Linux kernel, the following vulnerability has been resolved:

rust: block: fix GenDisk cleanup paths

GenDiskBuilder::build() still has fallible work after blkmqallocdisk(), but its error path only recovers the foreign queue data. That leaks the temporary gendisk and requestqueue until later teardown. If the caller moved the last Arc<TagSet<T>> into build(), the leaked queue can retain blk-mq state after the tag set is dropped.

Fix the pre-registration failure path by dropping the temporary gendisk reference with putdisk() before recovering queuedata, so diskrelease() can tear down the owned queue.

Also pair GenDisk::drop() with putdisk() after delgendisk(). Once a Rust GenDisk has been added with deviceadddisk(), delgendisk() only unregisters it; the final gendisk reference still has to be dropped to complete the release path.

Affected Software

3 affected componentsFixes available
Linux Linux kernel
debian/linux
6.1.176-16.1.190-16.12.107-16.12.115-27.2.12-17.2.15-1
debian/linux-6.12
6.12.113-1~deb12u1

Event History

Jul 25, 2026
CVE Published
via MITRE·08:52 AM
Data Sourced
via MITRE·08:52 AM
Description
Data Sourced
via NVD·10:17 AM
Description

Parent advisories

This vulnerability appears in the following advisories.

Peer vulnerabilities

Found alongside the following vulnerabilities.

Frequently Asked Questions

1

What is the severity of CVE-2026-64509?

CVE-2026-64509 has a risk score of 34, indicating it has a moderate severity level.

2

How do I fix CVE-2026-64509?

To fix CVE-2026-64509, ensure you are running the latest version of the Linux kernel where this vulnerability has been resolved.

3

What is the potential impact of CVE-2026-64509?

The potential impact of CVE-2026-64509 includes memory leaks that could lead to resource exhaustion on affected systems.

4

Is CVE-2026-64509 applicable to all versions of the Linux kernel?

CVE-2026-64509 is related specifically to the Linux kernel version within the context described and may not affect all versions.

5

When was CVE-2026-64509 published?

CVE-2026-64509 was published on July 25, 2026.

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203