CVE-2026-98832

Received Received - Intake

blk-cgroup: IRQ State Corruption Leading to Deadlock in Linux Kernel

Publication date: 2026-10-18

Last updated on: 2026-10-19

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: blk-cgroup: save IRQ state in blkg_tryget_closest() bio_set_dev() associates the bio with a blkg through bio_associate_blkg(). If the blkg lookup misses, blkg_tryget_closest() takes q->queue_lock with spin_lock_irq() and releases it with spin_unlock_irq(), which unconditionally enables local interrupts. Callers may call bio_set_dev() with interrupts already disabled, e.g. dm-thin's pool_map() does so while holding pool->lock taken with spin_lock_irq(). The nested spin_unlock_irq() then enables interrupts while pool->lock is still held, so an I/O completion softirq can run on the same CPU, re-acquire pool->lock (thin_endio(), or overwrite_endio() -> complete_mapping_preparation()) and deadlock. lockdep reports this as inconsistent SOFTIRQ-ON-W to IN-SOFTIRQ-W usage. Commit 3a762de55b4e ("block: save irq state in blkg_lookup_create()") fixed the same problem while the lock lived in blkg_lookup_create(), but commit 9327a865e395 ("blk-cgroup: don't nest queue_lock under rcu in blkg_lookup_create()") moved the locking into blkg_tryget_closest() and reverted it to spin_lock_irq(). Save and restore the caller's IRQ state instead.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-18

Last Modified

2026-10-19

Generated

2026-10-19

AI Q&A

2026-10-18

EPSS Evaluated

N/A

NVD

CVE-2026-98832

EUVD

EUVD-2026-103772

Affected Vendors & Products

Vendor	Product	Version / Range
Linux	Linux	9327a865e395a53f67dffac4710beb1d4730495e
Linux	Linux	9327a865e395a53f67dffac4710beb1d4730495e
Linux	Linux	7.2

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability in the Linux kernel involves improper handling of IRQ states in the block layer's cgroup code. Specifically, blkg_tryget_closest() uses spin_lock_irq() and spin_unlock_irq() which unconditionally enables interrupts. If called with interrupts already disabled, this can lead to a deadlock when softirqs re-acquire locks while holding them.

Detection Guidance

This vulnerability is specific to the Linux kernel's block I/O controller (blk-cgroup) and may not have direct network detection methods. Check kernel logs for lockdep warnings about inconsistent IRQ state or softirq-related deadlocks. Look for messages indicating SOFTIRQ-ON-W to IN-SOFTIRQ-W usage in dmesg or system logs.

Impact Analysis

This vulnerability can cause system hangs or deadlocks, leading to denial of service. Systems using dm-thin targets or similar configurations may crash or become unresponsive when I/O operations trigger the deadlock scenario.

Compliance Impact

This vulnerability does not directly affect compliance with standards like GDPR or HIPAA as it is a low-level kernel locking issue that could lead to system deadlocks rather than data breaches or privacy violations.

Mitigation Strategies

Apply the kernel patch that resolves this issue by saving and restoring IRQ state in blkg_tryget_closest(). Update to a patched kernel version if available. Monitor for lockdep warnings or softirq-related deadlocks after applying changes.

Hi! I’m here to help you understand CVE-2026-98832. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70