Cloudanix VulnDB

CVE-2026-98820

None

CVSS

—

EPSS

0.2%

Published

Oct 18, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A Linux kernel storage handling bug can cause disk operations to stall or slow down under certain conditions.

Exploitation
Local Privilege
Attacker needs
Local User
Complexity
Moderate
Impact
Denial Of Service
Component
OS kernel
Class
Race Condition
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

The flaw allows cached block requests allocated for one operation to be reused for another without properly setting RQF_USE_SCHED after the request is claimed, causing passthrough commands to bypass prepare_request/finish_request and leak scheduler domain tokens (e.g., in kyber), resulting in queue stalls.

Why it matters to the business

Linux systems may experience I/O scheduler stalls, reduced storage performance, or queue hangs during mixed passthrough and normal block operations, potentially disrupting workloads on affected kernels until patched; low immediate risk given recent publication and negligible EPSS.

How an attack unfolds

An attacker with local access crafts a sequence of passthrough commands followed by read/write bios that reuse the same request structure, bypassing scheduler initialization and triggering token leaks that stall the block queue.

How to fix it

Upgrade to a Linux kernel containing the fix that introduces blk_mq_rq_late_init() and sets RQF_USE_SCHED after operation claim; apply the patch that resolves the request reuse logic in blk-mq.

How to confirm the fix worked

Confirm the presence of blk_mq_rq_late_init() and the updated request flag logic in the kernel source or running kernel; test mixed passthrough and bio workloads to verify absence of kyber domain token leaks and queue stalls.

Typical attack path

  1. Obtain local execution context on a Linux system using the vulnerable blk-mq code path
  2. Issue passthrough commands that allocate requests with RQF_USE_SCHED cleared
  3. Trigger subsequent read/write operations that claim the same cached requests
  4. Observe or induce scheduler domain token leaks leading to queue stalls

How to detect it

Review kernel logs for scheduler-related stalls or token leak messages; inspect block layer traces for requests missing late initialization during mixed passthrough and bio activity.

What your security team should do

  • Prioritize kernel updates for systems with heavy block I/O and scheduler usage once fixed versions are available
  • Monitor upstream Linux kernel changelogs for the blk-mq request handling commit
  • Limit untrusted local access on storage-heavy systems until remediation is applied

The record

In the Linux kernel, the following vulnerability has been resolved: blk-mq: set RQF_USE_SCHED when the operation is known The cached requests are allocated for one operation but can be handed out for another. A passthrough command has RQF_USE_SCHED cleared, so using those flags for a subsequent read/write bio will insert it into the scheduler without ->prepare_request() and frees it without ->finish_request(). For kyber, this leaks the domain token acquired at dispatch and stalls the queue. Don't set RQF_USE_SCHED based on the first operation the batch happened to be allocated for. Instead, set it after the request is claimed by an operation. Introduce a helper function, blk_mq_rq_late_init() for this, and absorb blk_mq_rq_time_init() since the two run together.

Affected packages

Ecosystem Package Introduced Fixed