CVE-2026-90325: blk-cgroup: skip dying blkg in blkcg_activate_policy()
In the Linux kernel, the following vulnerability has been resolved:
blk-cgroup: skip dying blkg in blkcgactivatepolicy()
When switching IO schedulers on a block device, blkcgactivatepolicy() can race with concurrent blkcg deletion, leading to a use-after-free in rcuacceleratecbs.
T1: T2: blkgdestroy kill(&blkg->refcnt) // blkg->refcnt=1->0 blkgrelease // callrcu(blkgrelease) ... blkgfreeworkfn ->pdfreefn(pd) elvioschedstore elevatorswitch ... iterate blkg list blkgget(blkg) // blkg->refcnt=0->1 listdelinit(&blkg->qnode) blkgput(pinnedblkg) // blkg->refcnt=1->0 blkgrelease // callrcu again rcuacceleratecbs // uaf
Fix this by checking hlistunhashed(&blkg->blkcgnode) before getting a reference to the blkg. This is the same check used in blkgdestroy() to detect if a blkg has already been destroyed. If the blkg is already unhashed, skip processing it since it's being destroyed.
Affected Software
Event History
Frequently Asked Questions
What conditions are required to trigger this issue?
The race requires IO scheduler switching on a block device while a block cgroup is concurrently being deleted. The vulnerable path can then obtain a new reference to a blkcg object that is already being destroyed.
What is the resulting failure mode?
A destroyed blkcg can be released a second time, causing a use-after-free in rcu_accelerate_cbs.