Use-After-Free Vulnerability in Linux Kernel Affecting Block Control Groups

CVE-2026-63802

What is CVE-2026-63802?

A vulnerability exists within the Linux kernel involving block control groups (blkgs) that allows for a use-after-free condition. This occurs when multiple blkgs within the same blkcg (block control group) are released simultaneously, leading to a race condition. Specifically, this race happens during the execution of the __blkcg_rstat_flush() function, where one blkg attempts to remove iostat entries of another blkg. If the second blkg finds its list empty, it may initiate a self-freeing operation while the first blkg is still processing its entries, resulting in potential instability or exploitation. The vulnerability has been addressed by moving the flush operation out of the RCU callback into the blkg_release() function, ensuring proper synchronization and preventing premature deallocation.

References