CVE-2026-98820: blk-mq: set RQF_USE_SCHED when the operation is known
blk-mq: set RQFUSESCHED when the operation is known
Affected Software
Event History
Frequently Asked Questions
Which systems are exposed to this issue?
Systems using the Linux kernel block multiqueue layer with cached requests and an I/O scheduler are affected when a cached request allocated for one operation is later used for a different operation. The described queue stall specifically occurs with the kyber scheduler.
What conditions trigger the queue stall?
A passthrough command must leave RQF_USE_SCHED cleared on a cached request that is subsequently used for a read or write bio. That request can then enter the scheduler without prepare_request() and complete without finish_request(), leaking a kyber domain token acquired during dispatch.
How can administrators tell whether they are experiencing the issue?
The described observable effect is a stalled queue when using the kyber I/O scheduler. The provided data does not specify a log message, kernel version range, or a definitive runtime detection method.
What does the fix change?
The fix sets RQF_USE_SCHED after a request has been claimed for its actual operation, rather than basing the flag on the operation for which a cached request batch was originally allocated. It introduces blk_mq_rq_late_init() and combines the related request time initialization.