PT-2026-61118 · Linux · Linux

CVE-2026-63802 · Published 2026-07-19 · Updated 2026-07-19

NVD

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

In the Linux kernel, the following vulnerability has been resolved:

blk-cgroup: fix UAF in blkcg rstat flush()

When multiple blkgs in the same blkcg are released concurrently, a use-after-free can occur. The race happens when one blkg's blkcg rstat flush() removes another blkg's iostat entries via llist del all(). The second blkg sees an empty list and proceeds to free itself while the first is still iterating over its entries.

Move the flush from blkg release() (RCU callback) to blkg release() (before call rcu). This ensures the RCU grace period waits for any concurrent flush's rcu read lock() section to complete before freeing.

Fix

Related Identifiers

CVE-2026-63802

Affected Products

Linux

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2026-63802 · Security Note
• https://git.kernel.org/stable/c/96e545410c4f74c89d496c1d5d9ef8d08f14368b · Note
• https://git.kernel.org/stable/c/0ab5ee5a1badb58cbb2242617cb01a4972b1f2a2 · Note
• https://git.kernel.org/stable/c/5e5b7f2ef854936e95dceb6a2fdfefcb7152d2c6 · Note
• https://git.kernel.org/stable/c/bbebd9425cad3573d1527441753899b926525a0f · Note
• https://git.kernel.org/stable/c/afebe44facc48a61761e885bbb7f0380d4a603ec · Note