CVE-2026-63802

blk-cgroup: fix UAF in __blkcg_rstat_flush()

State: Published
Severity: 7.8 High
Published: Jul 19, 2026
Updated: Oct 19, 2026
Reserved: Jul 19, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

blk-cgroup: fix UAF in __blkcg_rstat_flush()

When multiple blkgs in the same blkcg are released concurrently, a use-after-free can occur. The race happens when one blkg's __blkcg_rstat_flush() removes another blkg's iostat entries via llist_del_all(). The second blkg sees an empty list and proceeds to free itself while the first is still iterating over its entries.

Move the flush from __blkg_release() (RCU callback) to blkg_release() (before call_rcu). This ensures the RCU grace period waits for any concurrent flush's rcu_read_lock() section to complete before freeing.

Scores

CVSS	Score	Vector	Source
3.1	7.8 High	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H	Linux

Weaknesses

CWE-362 Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

Affected Products

Product	Versions
LinuxLinux	20cb1c2fb7568a6054c55defe044311397e01ddb to before 96e545410c4f74c89d496c1d5d9ef8d08f14368bAffected 20cb1c2fb7568a6054c55defe044311397e01ddb to before bbebd9425cad3573d1527441753899b926525a0fAffected 20cb1c2fb7568a6054c55defe044311397e01ddb to before 5e5b7f2ef854936e95dceb6a2fdfefcb7152d2c6Affected 20cb1c2fb7568a6054c55defe044311397e01ddb to before afebe44facc48a61761e885bbb7f0380d4a603ecAffected 20cb1c2fb7568a6054c55defe044311397e01ddb to before 0ab5ee5a1badb58cbb2242617cb01a4972b1f2a2Affected 0f6090d90f627d8c58f939067d6c6821ce1b3c68Affected 6.3.9 to before 6.4Affected
LinuxLinux	6.4Affected before 6.4Not affected 6.6.144 through 6.6.Not affected 6.12.95 through 6.12.Not affected 6.18.38 through 6.18.Not affected 7.1.3 through 7.1.Not affected 7.2 and laterNot affected

Product

Versions

LinuxLinux

20cb1c2fb7568a6054c55defe044311397e01ddb to before 96e545410c4f74c89d496c1d5d9ef8d08f14368bAffected
20cb1c2fb7568a6054c55defe044311397e01ddb to before bbebd9425cad3573d1527441753899b926525a0fAffected
20cb1c2fb7568a6054c55defe044311397e01ddb to before 5e5b7f2ef854936e95dceb6a2fdfefcb7152d2c6Affected
20cb1c2fb7568a6054c55defe044311397e01ddb to before afebe44facc48a61761e885bbb7f0380d4a603ecAffected
20cb1c2fb7568a6054c55defe044311397e01ddb to before 0ab5ee5a1badb58cbb2242617cb01a4972b1f2a2Affected
0f6090d90f627d8c58f939067d6c6821ce1b3c68Affected
6.3.9 to before 6.4Affected

LinuxLinux

6.4Affected
before 6.4Not affected
6.6.144 through 6.6.*Not affected
6.12.95 through 6.12.*Not affected
6.18.38 through 6.18.*Not affected
7.1.3 through 7.1.*Not affected
7.2 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.