UBUNTU-CVE-2026-90326: Use After Free

In the Linux kernel, the following vulnerability has been resolved: blk-cgroup: fix race between policy activation and blkg destruction When switching an IO scheduler on a block device, blkcgactivatepolicy() allocates blkgpolicydata (pd) for all blkgs attached to the queue. However, blkcgactivatepolicy() may race with concurrent blkcg deletion, leading to use-after-free and memory leak issues. The use-after-free occurs in the following race: T1 (blkcgactivatepolicy): - Successfully allocates pd for blkg1 (loop0->queue, blkcgA) - Fails to allocate pd for blkg2 (loop0->queue, blkcgB) - Enters the enomem rollback path to release blkg1 resources T2 (blkcg deletion): - blkcgA is deleted concurrently - blkg1 is freed via blkgfreeworkfn() - blkg1->pd is freed T1 (continued): - Rollback path accesses blkg1->pd->online after pd is freed - Triggers use-after-free In addition, blkgfreeworkfn() frees pd before removing the blkg from q->blkglist. This allows blkcgactivatepolicy() to allocate a new pd for a blkg that is being destroyed, leaving the newly allocated pd unreachable when the blkg is finally freed. Fix these races by extending blkcgmutex coverage to serialize blkcgactivatepolicy() rollback and blkg destruction, ensuring pd lifecycle is synchronized with blkg list visibility.