CVE-2026-63802
Received Received - Intake

Use-After-Free in Linux Kernel Block I/O Controller

Publication date: 2026-07-19

Last updated on: 2026-07-19

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: blk-cgroup: fix UAF in __blkcg_rstat_flush() When multiple blkgs in the same blkcg are released concurrently, a use-after-free can occur. The race happens when one blkg's __blkcg_rstat_flush() removes another blkg's iostat entries via llist_del_all(). The second blkg sees an empty list and proceeds to free itself while the first is still iterating over its entries. Move the flush from __blkg_release() (RCU callback) to blkg_release() (before call_rcu). This ensures the RCU grace period waits for any concurrent flush's rcu_read_lock() section to complete before freeing.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-19
Last Modified
2026-07-19
Generated
2026-07-20
AI Q&A
2026-07-19
EPSS Evaluated
N/A
NVD
CVE-2026-63802
EUVD
EUVD-2026-45468

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
linux linux_kernel *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a use-after-free (UAF) vulnerability in the Linux kernel's block I/O controller (blk-cgroup). It occurs when multiple block I/O groups (blkgs) in the same controller are released at the same time, causing a race condition where one group's cleanup process frees memory while another is still accessing it.

Detection Guidance

This vulnerability is specific to the Linux kernel's block I/O controller (blk-cgroup) and may not have direct network detection methods. Monitor kernel logs for crashes or errors related to blk-cgroup or I/O statistics. Check for kernel panics or warnings in dmesg output using 'dmesg | grep -i blkcg' or 'dmesg | grep -i iostat'.

Impact Analysis

This vulnerability could lead to system crashes, data corruption, or privilege escalation if exploited. It affects systems using the Linux kernel's block I/O controller, potentially impacting performance and stability of storage operations.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR, HIPAA, or similar standards. It is a use-after-free issue in the Linux kernel's block I/O controller, which could lead to system instability or crashes but does not inherently impact data protection or privacy requirements.

Mitigation Strategies

Update the Linux kernel to the latest stable version that includes the fix for CVE-2026-63802. If immediate patching is not possible, consider disabling blk-cgroup features if they are not critical to your system's operation.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-63802. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart