UBUNTU-CVE-2026-90183: Medium severity ubuntu/linux-hwe-edge vulnerability

In the Linux kernel, the following vulnerability has been resolved: blk-iolatency: clear delay state when freeing policy data io.latency can throttle a group which has no latency target of its own. When a sibling misses its target, checkscalechange() scales down its peers, and a peer that reaches queue depth one gets blkcgusedelay() called on it on every further scale-down, even with minlatnsec == 0. iolatencypdoffline() resets the target through iolatencysetminlatnsec(), which clears the delay only on a nonzero to zero transition, so it never clears such a peer. Freeing the policy data then leaves blkg->usedelay set and blkcg->congestioncount elevated with nothing left that can drop it. blkcgroupcongested() then returns true for every task in that cgroup and its descendants for as long as the cgroup lives: pagecachesyncra() cuts readahead to a single page, pagecacheasyncra() skips it altogether, and foliothrottleswaprate() takes swapavaillock and schedules a throttle on anonymous folio allocation. Clear the delay in iolatencypdfree(). By then bio-held blkg references have drained, or the queue is frozen for policy deactivation, so checkscalechange() cannot re-arm it. The free callback can also see policy data which was never attached to a blkg, hence the pd->blkg check.