CVE-2026-98832

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

blk-cgroup: save IRQ state in blkg_tryget_closest()

bio_set_dev() associates the bio with a blkg through bio_associate_blkg().

If the blkg lookup misses, blkg_tryget_closest() takes q->queue_lock with

spin_lock_irq() and releases it with spin_unlock_irq(), which

unconditionally enables local interrupts.

Callers may call bio_set_dev() with interrupts already disabled, e.g.

dm-thin's pool_map() does so while holding pool->lock taken with

spin_lock_irq(). The nested spin_unlock_irq() then enables interrupts

while pool->lock is still held, so an I/O completion softirq can run on

the same CPU, re-acquire pool->lock (thin_endio(), or overwrite_endio()

-> complete_mapping_preparation()) and deadlock. lockdep reports this

as inconsistent SOFTIRQ-ON-W to IN-SOFTIRQ-W usage.

Commit 3a762de55b4e ("block: save irq state in blkg_lookup_create()")

fixed the same problem while the lock lived in blkg_lookup_create(), but

commit

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References