CVE-2026-90325: blk-cgroup: skip dying blkg in blkcg_activate_policy()
In the Linux kernel, the following vulnerability has been resolved:
blk-cgroup: skip dying blkg in blkcgactivatepolicy()
When switching IO schedulers on a block device, blkcgactivatepolicy() can race with concurrent blkcg deletion, leading to a use-after-free in rcuacceleratecbs.
T1: T2: blkgdestroy kill(&blkg->refcnt) // blkg->refcnt=1->0 blkgrelease // callrcu(blkgrelease) ... blkgfreeworkfn ->pdfreefn(pd) elvioschedstore elevatorswitch ... iterate blkg list blkgget(blkg) // blkg->refcnt=0->1 listdelinit(&blkg->qnode) blkgput(pinnedblkg) // blkg->refcnt=1->0 blkgrelease // callrcu again rcuacceleratecbs // uaf
Fix this by checking hlistunhashed(&blkg->blkcgnode) before getting a reference to the blkg. This is the same check used in blkgdestroy() to detect if a blkg has already been destroyed. If the blkg is already unhashed, skip processing it since it's being destroyed.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.12.115-2Fixed in 7.2.12-1Fixed in 7.2.15-1 - Upgrade
Upgrade
debian/linux-6.12to a version that resolves this vulnerability.Fixed in 6.12.113-1~deb12u1 - Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-42.42 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1016.17 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1016.18 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1015.16 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1 - Compensating control
In the Linux kernel blk-cgroup implementation, update blkcg_activate_policy() to check hlist_unhashed(&blkg->blkcg_node) before obtaining a reference to the blkg, and skip processing the blkg when it is already unhashed because it is being destroyed.
Event History
Frequently Asked Questions
What conditions are required to trigger this issue?
The race requires IO scheduler switching on a block device while a block cgroup is concurrently being deleted. The vulnerable path can then obtain a new reference to a blkcg object that is already being destroyed.
What is the resulting failure mode?
A destroyed blkcg can be released a second time, causing a use-after-free in rcu_accelerate_cbs.