UBUNTU-CVE-2026-90182: Low severity ubuntu/linux-hwe-edge vulnerability
In the Linux kernel, the following vulnerability has been resolved: blk-iocost: clear delay state when freeing policy data iocgkickdelay() turns sufficiently large debt into an explicit block-cgroup delay with blkcgsetdelay(), setting blkg->usedelay to -1 and incrementing blkcg->congestioncount. Clearing it again depends on iocgkickdelay() running from the period timer, the waitq timer or the issue path. iocpdfree() removes the iocg from activeiocgs and cancels its waitq timer, and no further bios can arrive, so once it has run nothing is left which can reduce the debt and clear the delay. The blkcg stays marked congested for the rest of its life. blkcgroupcongested() then returns true for every task in that cgroup and its descendants: pagecachesyncra() cuts readahead to a single page, pagecacheasyncra() skips it altogether, and foliothrottleswaprate() takes swapavaillock and schedules a throttle on anonymous folio allocation. Clear it explicitly, after the list removal and the synchronous hrtimercancel() so that neither timer processing nor an I/O path can re-arm it. The free callback can also see policy data which was never attached to a blkg, hence the pd->blkg check.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-42.42 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1016.17 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1016.18 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1015.16 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1 - Compensating control
In ioc_pd_free(), after removing the iocg from active_iocgs and synchronously cancelling its waitq timer with hrtimer_cancel(), explicitly clear the blkcg delay state when pd->blkg exists, so neither timer processing nor an I/O path can re-arm it.