CVE-2026-63802

What it actually does

Use-after-free in __blkcg_rstat_flush() triggered when multiple blkgs in the same blkcg are released concurrently, with one blkg's flush removing another's iostat entries via llist_del_all() while the second blkg frees itself.

Why it matters to the business

Local attackers can achieve kernel-level code execution or cause system crashes on Linux hosts, resulting in full compromise of servers, containers, or embedded devices and potential disruption of workloads.

How an attack unfolds

An attacker with local access creates concurrent blkg release conditions in the block cgroup subsystem; the race allows access to freed iostat structures during rstat flush, leading to memory corruption that can be leveraged for privilege escalation.

How to fix it

Apply a kernel patch that moves the flush operation from the __blkg_release() RCU callback into blkg_release() before the call_rcu invocation; rebuild and deploy the updated kernel across all affected systems.

How to confirm the fix worked

Inspect the blk-cgroup.c source to confirm the flush logic has been relocated before the RCU grace period; boot the patched kernel and exercise blkcg workloads to ensure no UAF reports appear in kernel logs.

Typical attack path

1. Obtain local user access on a Linux system
2. Trigger concurrent release of multiple blkgs sharing a blkcg
3. Race the __blkcg_rstat_flush() and blkg free paths to hit the UAF
4. Corrupt kernel memory to execute arbitrary code or crash the kernel

How to detect it

Review kernel logs for oops or panic messages involving blk-cgroup or rstat flushing; monitor for unexpected memory corruption indicators during high blkcg churn workloads.

What your security team should do

• Prioritize kernel updates on all exposed Linux systems
• Limit untrusted local access and container workloads until patched
• Enable kernel hardening features such as KASAN in test environments to catch similar issues