CVE-2026-90326

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

blk-cgroup: fix race between policy activation and blkg destruction

When switching an IO scheduler on a block device, blkcg_activate_policy()

allocates blkg_policy_data (pd) for all blkgs attached to the queue.

However, blkcg_activate_policy() may race with concurrent blkcg deletion,

leading to use-after-free and memory leak issues.

The use-after-free occurs in the following race:

T1 (blkcg_activate_policy):

- Successfully allocates pd for blkg1 (loop0->queue, blkcgA)

- Fails to allocate pd for blkg2 (loop0->queue, blkcgB)

- Enters the enomem rollback path to release blkg1 resources

T2 (blkcg deletion):

- blkcgA is deleted concurrently

- blkg1 is freed via blkg_free_workfn()

- blkg1->pd is freed

T1 (continued):

- Rollback path accesses blkg1->pd->online after pd is freed

- Triggers use-after-free

In addition, blkg_free_workfn() frees pd before removing the blkg from

q->blkg_list. This allows blkc

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References