HIGH
block BlkgActivate UAF
CVE-2026-90325
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
KernelScan AI6.7MEDIUM
01Description
In the Linux kernel, the following vulnerability has been resolved: blk-cgroup: skip dying blkg in blkcg_activate_policy() When switching IO schedulers on a block device, blkcg_activate_policy() can race with concurrent blkcg deletion, leading to a use-after-free in rcu_accelerate_cbs. T1: T2: blkg_destroy kill(&blkg->refcnt) // blkg->refcnt=1->0 blkg_release // call_rcu(__blkg_release) ... blkg_free_workfn ->pd_free_fn(pd) elv_iosched_store elevator_switch ... iterate blkg list blkg_get(blkg) // blkg->refcnt=0->1 list_del_init(&blkg->q_node) blkg_put(pinned_blkg) // blkg->refcnt=1->0 blkg_release // call_rcu again rcu_accelerate_cbs // uaf Fix this by checking hlist_unhashed(&blkg->blkcg_node) before getting a reference to the blkg. This is the same check used in blkg_destroy() to detect if a blkg has already been destroyed. If the blkg is already unhashed, skip processing it since it's being destroyed.
02KernelScan AI Analysis
Risk summary
A use-after-free occurs in the block cgroup subsystem when an IO scheduler switch races with concurrent block cgroup group deletion. A privileged local attacker who can trigger both operations can cause kernel memory corruption, potentially leading to arbitrary read/write or a system crash. Exploitation requires winning a narrow race window and root-level privileges to access block device sysfs attributes.
Vulnerability analysis
When switching IO schedulers on a block device, the kernel walks through block cgroup entities to activate a new policy. If one of those entities is being destroyed at the same time—its lifetime already ended and its memory queued for later reclamation—the walk can still see it and resurrect it by acquiring a new reference. Dropping that reference later fires a second reclamation on memory that has already been freed, corrupting internal kernel callback structures and causing a use-after-free. The fix checks whether an entity has already been marked for destruction and removed from the internal list before acquiring a reference, skipping it if so. This vulnerability is reachable locally by a user with root or equivalent privileges who can write to block device sysfs attributes to trigger an IO scheduler switch while block cgroup deletion is concurrently in progress.
Lifecycle
03Fix Versions
| Branch | Introduced | Fixed in | Patch commit |
|---|---|---|---|
| 6.1 | 6.1.16 | 6.1.17 | b5dae1cd0d83 |
| 6.12 | — | 6.12.110 | 7337d012ca3f |
| 6.18 | — | 6.18.52 | 3d8c3da95c75 |
| 6.2 | 6.2.3 | 6.2.4 | 083b58373463 |
| 6.6 | — | 6.6.157 | 1a267295b1ea |
| 7.2 | — | 7.2.6 | d8c872901e64 |
| mainline | — | 7.3 | 5e9220389920 |
| cip/6.1 | — | 6.1.189-cip61 | 0489f95b79cf |
| cip/6.1-rt | — | 6.1.189-cip61-rt32 | 0489f95b79cf |
| cip/6.12 | — | 6.12.111-cip32 | 7337d012ca3f |
04CIP Kernels
State of the newest release of each Civil Infrastructure Platform SLTS tree, from CIP's own fix records.
| CIP tree | State |
|---|---|
| cip/6.12 | Fixed in 6.12.111-cip32 |
| cip/6.1 | Fixed in 6.1.189-cip61 |
| cip/6.1-rt | Fixed in 6.1.189-cip61-rt32 |