Vulnerability in Linux Kernel Affecting Request Scheduling

CVE-2026-98820

What is CVE-2026-98820?

The Linux kernel has a vulnerability related to request scheduling in the block multiqueue (blk-mq) subsystem. This issue arises when cached requests that are allocated for one operation are incorrectly handed out for another. Specifically, the passthrough command clears the RQF_USE_SCHED flag, leading to improper insertion of a subsequent read or write block I/O operation into the scheduler. This mismanagement can result in a leaked domain token acquired during dispatch, ultimately causing the queue to stall. To mitigate this issue, a modification was introduced to set the RQF_USE_SCHED flag only after the request is claimed by the appropriate operation, enhancing request management and system stability.

References