CVE-2026-98820: blk-mq: set RQF_USE_SCHED when the operation is known

Published Oct 18, 2026

Updated

In the Linux kernel, the following vulnerability has been resolved:

blk-mq: set RQFUSESCHED when the operation is known

The cached requests are allocated for one operation but can be handed out for another. A passthrough command has RQFUSESCHED cleared, so using those flags for a subsequent read/write bio will insert it into the scheduler without ->preparerequest() and frees it without ->finishrequest(). For kyber, this leaks the domain token acquired at dispatch and stalls the queue.

Don't set RQFUSESCHED based on the first operation the batch happened to be allocated for. Instead, set it after the request is claimed by an operation. Introduce a helper function, blkmqrqlateinit() for this, and absorb blkmqrqtimeinit() since the two run together.

Affected Software

1 affected component

Linux Linux kernel

Event History

Oct 18, 2026

CVE Published

via MITRE·03:49 PM

Data Sourced

via MITRE·03:49 PM

Description

Data Sourced

via NVD·04:17 PM

Description

Frequently Asked Questions

Which systems are exposed to this issue?

Systems using the Linux kernel block multiqueue layer with cached requests and an I/O scheduler are affected when a cached request allocated for one operation is later used for a different operation. The described queue stall specifically occurs with the kyber scheduler.

What conditions trigger the queue stall?

A passthrough command must leave RQF_USE_SCHED cleared on a cached request that is subsequently used for a read or write bio. That request can then enter the scheduler without prepare_request() and complete without finish_request(), leaking a kyber domain token acquired during dispatch.

How can administrators tell whether they are experiencing the issue?

The described observable effect is a stalled queue when using the kyber I/O scheduler. The provided data does not specify a log message, kernel version range, or a definitive runtime detection method.

What does the fix change?

The fix sets RQF_USE_SCHED after a request has been claimed for its actual operation, rather than basing the flag on the operation for which a cached request batch was originally allocated. It introduces blk_mq_rq_late_init() and combines the related request time initialization.

CVE-2026-98820: blk-mq: set RQF_USE_SCHED when the operation is known

Affected Software

Event History

Frequently Asked Questions

Which systems are exposed to this issue?

What conditions trigger the queue stall?

How can administrators tell whether they are experiencing the issue?

What does the fix change?

Company

Resources

Contact

Frequently Asked Questions

Which systems are exposed to this issue?

What conditions trigger the queue stall?

How can administrators tell whether they are experiencing the issue?

What does the fix change?