CVE-2026-90182: blk-iocost: clear delay state when freeing policy data
blk-iocost: clear delay state when freeing policy data
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.1.191 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.6.160 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.12.114 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.18.57 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 7.2.6 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 7.2.6-1 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 7.2.12-1Fixed in 7.2.14-1 - Compensating control
In ioc_pd_free(), when pd->blkg is present, explicitly clear the block-cgroup delay state after removing the iocg from active_iocgs and synchronously calling hrtimer_cancel(), so timer processing and I/O paths cannot re-arm the delay.
Event History
Frequently Asked Questions
Which workloads are affected by the lingering congestion state?
Tasks in the affected block cgroup and all of its descendant cgroups are affected. The condition occurs when sufficiently large I/O cost debt has created an explicit block-cgroup delay and the policy data is then freed before a timer or I/O path can clear that delay.
What operational symptoms can indicate that a cgroup remains incorrectly congested?
Synchronous page-cache readahead is reduced to one page, asynchronous readahead is skipped, and anonymous folio allocation can be throttled for swap-rate control. These behaviors persist for the lifetime of the affected block cgroup once its congestion state is left set.
What clears the affected state in the resolved implementation?
The delay state is explicitly cleared during policy-data cleanup, after removal from the active I/O cgroup list and synchronous cancellation of the wait-queue timer. This prevents timer processing or I/O activity from re-arming the delay during cleanup.