CVE-2026-63802

Awaiting Analysis Awaiting Analysis - Queue

Use-After-Free in Linux Kernel Block I/O Controller

Publication date: 2026-07-19

Last updated on: 2026-07-29

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: blk-cgroup: fix UAF in __blkcg_rstat_flush() When multiple blkgs in the same blkcg are released concurrently, a use-after-free can occur. The race happens when one blkg's __blkcg_rstat_flush() removes another blkg's iostat entries via llist_del_all(). The second blkg sees an empty list and proceeds to free itself while the first is still iterating over its entries. Move the flush from __blkg_release() (RCU callback) to blkg_release() (before call_rcu). This ensures the RCU grace period waits for any concurrent flush's rcu_read_lock() section to complete before freeing.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-19

Last Modified

2026-07-29

Generated

2026-08-09

AI Q&A

2026-07-19

EPSS Evaluated

2026-08-08

NVD

CVE-2026-63802

EUVD

EUVD-2026-45468

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	6.4
linux	linux_kernel	6.4
linux	linux_kernel	From 6.3.9 (inc) to 6.4 (exc)
linux	linux_kernel	From 6.7 (inc) to 6.12.95 (exc)
linux	linux_kernel	From 6.13 (inc) to 6.18.38 (exc)
linux	linux_kernel	From 6.19 (inc) to 7.1.3 (exc)
linux	linux_kernel	From 6.4.1 (inc) to 6.6.144 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-416	The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.

Attack-Flow Graph

Executive Summary

This is a use-after-free (UAF) vulnerability in the Linux kernel's block I/O controller (blk-cgroup). It occurs when multiple block I/O groups (blkgs) in the same controller are released at the same time, causing a race condition where one group's cleanup process frees memory while another is still accessing it.

Detection Guidance

This vulnerability is specific to the Linux kernel's block I/O controller (blk-cgroup) and may not have direct network detection methods. Monitor kernel logs for crashes or errors related to blk-cgroup or I/O statistics. Check for kernel panics or warnings in dmesg output using 'dmesg | grep -i blkcg' or 'dmesg | grep -i iostat'.

Impact Analysis

This vulnerability could lead to system crashes, data corruption, or privilege escalation if exploited. It affects systems using the Linux kernel's block I/O controller, potentially impacting performance and stability of storage operations.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR, HIPAA, or similar standards. It is a use-after-free issue in the Linux kernel's block I/O controller, which could lead to system instability or crashes but does not inherently impact data protection or privacy requirements.

Mitigation Strategies

Update the Linux kernel to the latest stable version that includes the fix for CVE-2026-63802. If immediate patching is not possible, consider disabling blk-cgroup features if they are not critical to your system's operation.

Hi! I’m here to help you understand CVE-2026-63802. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70