Cloudanix VulnDB

CVE-2026-90325

High · 7.8

CVSS

7.8

EPSS

0.2%

Published

Sep 17, 2026

CISA due date

—

Cloudanix analysis

Next patch cycle SSVC: Track

A flaw in how the Linux kernel manages certain storage-device settings can let a local user crash the whole system or possibly take it over.

Exploitation
Local Privilege
Attacker needs
Local User
Complexity
Moderate
Impact
Full Compromise
Component
OS kernel
Class
Use After Free
Remediation
Patch
Effort
Medium
Patch risk
Low

What it actually does

Race between blkcg_activate_policy during elevator switch and concurrent blkg_destroy leads to use-after-free when rcu_accelerate_cbs is called on a freed blkg after its refcount reaches zero.

Why it matters to the business

Local attackers on affected Linux systems can crash the kernel or potentially execute arbitrary code, resulting in denial of service, data loss, or full host compromise during block-device or cgroup operations.

How an attack unfolds

An attacker with local access triggers an IO scheduler change while simultaneously deleting a blkcg, racing the reference-count and list operations so that a destroyed blkg is re-referenced and later freed again, hitting the UAF in RCU callbacks.

How to fix it

Apply the upstream fix that adds the hlist_unhashed check before taking a reference in blkcg_activate_policy; rebuild and boot the patched kernel. Reboot is required after installation.

How to confirm the fix worked

Inspect the blk-cgroup.c source for the added hlist_unhashed(&blkg->blkcg_node) guard before blkg_get; verify the kernel build contains the commit that resolves the described race; test concurrent scheduler changes and cgroup deletions under load.

Typical attack path

  1. Obtain local shell or code execution on the target host
  2. Open or manipulate a block device that uses blk-cgroup policies
  3. Concurrently issue an elevator switch and trigger blkcg deletion
  4. Force the race window that re-references the dying blkg
  5. Trigger RCU callback processing to dereference the freed object

How to detect it

Review kernel logs for RCU-related use-after-free warnings or oops mentioning rcu_accelerate_cbs, blkcg, or elevator_switch; correlate with audit logs showing concurrent cgroup deletion and IO scheduler changes.

What your security team should do

  • Patch and reboot all Linux systems exposing block devices or cgroups within the next maintenance window
  • Restrict unprivileged local access and scheduler-change capabilities until patches are deployed
  • Monitor kernel crash reports and RCU-related oops for signs of exploitation
  • Review downstream distributions for backported fixes and schedule upgrades accordingly

The record

In the Linux kernel, the following vulnerability has been resolved: blk-cgroup: skip dying blkg in blkcg_activate_policy() When switching IO schedulers on a block device, blkcg_activate_policy() can race with concurrent blkcg deletion, leading to a use-after-free in rcu_accelerate_cbs. T1: T2: blkg_destroy kill(&blkg->refcnt) // blkg->refcnt=1->0 blkg_release // call_rcu(__blkg_release) ... blkg_free_workfn ->pd_free_fn(pd) elv_iosched_store elevator_switch ... iterate blkg list blkg_get(blkg) // blkg->refcnt=0->1 list_del_init(&blkg->q_node) blkg_put(pinned_blkg) // blkg->refcnt=1->0 blkg_release // call_rcu again rcu_accelerate_cbs // uaf Fix this by checking hlist_unhashed(&blkg->blkcg_node) before getting a reference to the blkg. This is the same check used in blkg_destroy() to detect if a blkg has already been destroyed. If the blkg is already unhashed, skip processing it since it's being destroyed.

Affected packages

Ecosystem Package Introduced Fixed