7.8

CVE-2026-63802

blk-cgroup: fix UAF in __blkcg_rstat_flush()

In the Linux kernel, the following vulnerability has been resolved:

blk-cgroup: fix UAF in __blkcg_rstat_flush()

When multiple blkgs in the same blkcg are released concurrently,
a use-after-free can occur. The race happens when one blkg's
__blkcg_rstat_flush() removes another blkg's iostat entries via
llist_del_all(). The second blkg sees an empty list and proceeds
to free itself while the first is still iterating over its entries.

Move the flush from __blkg_release() (RCU callback) to blkg_release()
(before call_rcu). This ensures the RCU grace period waits for any
concurrent flush's rcu_read_lock() section to complete before freeing.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Linux ≫ Linux Kernel Version >= 6.3.9 < 6.4
Linux ≫ Linux Kernel Version >= 6.4.1 < 6.6.144
Linux ≫ Linux Kernel Version >= 6.7 < 6.12.95
Linux ≫ Linux Kernel Version >= 6.13 < 6.18.38
Linux ≫ Linux Kernel Version >= 6.19 < 7.1.3
Linux ≫ Linux Kernel Version6.4 Update-
Linux ≫ Linux Kernel Version6.4 Updaterc7
VulnDex Vulnerability Enrichment
Diese Information steht angemeldeten Benutzern zur Verfügung. Login Login
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.14% 0.036
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
416baaa9-dc9f-4396-8d5f-8c081fb06d67 7.8 1.8 5.9
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CWE-416 Use After Free

The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.

https://git.kernel.org/stable/c/96e545410c4f74c89d496c1d5d9ef8d08f14368b
Patch
https://git.kernel.org/stable/c/bbebd9425cad3573d1527441753899b926525a0f
Patch
https://git.kernel.org/stable/c/5e5b7f2ef854936e95dceb6a2fdfefcb7152d2c6
Patch
https://git.kernel.org/stable/c/afebe44facc48a61761e885bbb7f0380d4a603ec
Patch
https://git.kernel.org/stable/c/0ab5ee5a1badb58cbb2242617cb01a4972b1f2a2
Patch