UBUNTU-CVE-2026-90325: Use After Free
In the Linux kernel, the following vulnerability has been resolved: blk-cgroup: skip dying blkg in blkcgactivatepolicy() When switching IO schedulers on a block device, blkcgactivatepolicy() can race with concurrent blkcg deletion, leading to a use-after-free in rcuacceleratecbs. T1: T2: blkgdestroy kill(&blkg->refcnt) // blkg->refcnt=1->0 blkgrelease // callrcu(blkgrelease) ... blkgfreeworkfn ->pdfreefn(pd) elvioschedstore elevatorswitch ... iterate blkg list blkgget(blkg) // blkg->refcnt=0->1 listdelinit(&blkg->qnode) blkgput(pinnedblkg) // blkg->refcnt=1->0 blkgrelease // callrcu again rcuacceleratecbs // uaf Fix this by checking hlistunhashed(&blkg->blkcgnode) before getting a reference to the blkg. This is the same check used in blkgdestroy() to detect if a blkg has already been destroyed. If the blkg is already unhashed, skip processing it since it's being destroyed.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-42.42 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1016.17 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1016.18 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1015.16 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1 - Compensating control
In blkcg_activate_policy(), check hlist_unhashed(&blkg->blkcg_node) before calling blkg_get(blkg), and skip the blkg if it is already unhashed or dying.
Event History
Frequently Asked Questions
Which Ubuntu kernel packages are identified as affected?
The affected software list includes ubuntu/linux-riscv, ubuntu/linux-realtime, ubuntu/linux-azure, ubuntu/linux-gcp, ubuntu/linux-azure-fde, ubuntu/linux-gke, ubuntu/linux-hwe-edge, and ubuntu/linux-gkeop.
What conditions are needed to trigger the vulnerability?
The issue requires a local attacker with low privileges and no user interaction. It is triggered by a race between deletion of a block cgroup and an I/O scheduler switch on a block device.
What is the potential impact of successful exploitation?
The race can cause a use-after-free in rcu_accelerate_cbs. The provided severity vector rates confidentiality, integrity, and availability impacts as high.
What code change resolves the race?
The fix checks whether the block cgroup node is unhashed before taking a reference in blkcg_activate_policy(). If it is already unhashed, processing is skipped because the block cgroup is being destroyed.