CVE-2026-93795: blk-cgroup: fix leaks and online flag on radix_tree_insert failure
In the Linux kernel, the following vulnerability has been resolved:
blk-cgroup: fix leaks and online flag on radixtreeinsert failure
When radixtreeinsert() fails in blkgcreate(), the error path has two issues:
1. blkg->online is set to true unconditionally, even when the blkg was never fully inserted. Move the assignment inside the success block.
2. The error path calls blkgput() without first calling percpurefkill(). Because the refcount is still in percpu mode, percpurefput() only does thiscpusub() without checking for zero, so blkgrelease() is never triggered. This permanently leaks the blkg memory, its percpu iostat, policy data, the parent blkg reference, and the cgroup css reference — the latter preventing the cgroup from ever being destroyed.
Fix by replacing blkgput() with percpurefkill(), matching the pattern used in blkgdestroy().
Affected Software
Event History
Frequently Asked Questions
What condition is required to trigger the leak?
The failure path is triggered when radix_tree_insert() fails during blkg_create(). The provided information does not identify the external conditions that cause that insertion to fail.
What are the operational effects if the failure occurs?
The affected blk-cgroup object and associated per-CPU I/O statistics, policy data, parent blkg reference, and cgroup css reference can be permanently leaked. The retained cgroup css reference can prevent the cgroup from being destroyed.
How does the fix address the problem?
It sets blkg->online only after successful radix-tree insertion and replaces blkg_put() with percpu_ref_kill() on the insertion-failure path. Killing the per-CPU reference allows normal release processing to occur.