CVE-2026-64017
Received Received - Intake

Use-After-Free in Linux Kernel blk-mq

Publication date: 2026-07-19

Last updated on: 2026-07-19

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: blk-mq: pop cached request if it is usable When submitting a bio to blk-mq, if the task should sleep after peeking a cached request, but before it pops it, the plug flushes and calls blk_mq_free_plug_rqs, freeing the cached_rqs. This creates a use-after-free bug. Fix this by popping the cached request before any possible blocking calls if it is suitable for use. Popping this request first holds a queue reference, so avoid any serialization races with queue freezes and can safely proceed with dispatching that request to the driver. This potentially increases a timing window from when a driver wants to freeze its queue to when requests stop being dispatched. That scenario is off the fast path though, and drivers need to appropriately handle requests during a freeze request anyway. The downside is the popped element needs to be individually freed when we performed a bio plug merge. The cached request would have had to be freed later anyway, but this patch does it inline with building the plug list instead of after flushing it.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-19
Last Modified
2026-07-19
Generated
2026-07-20
AI Q&A
2026-07-19
EPSS Evaluated
N/A
NVD
CVE-2026-64017
EUVD
EUVD-2026-45590

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
linux linux_kernel *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a use-after-free vulnerability in the Linux kernel's block I/O subsystem (blk-mq). It occurs when a cached request is accessed after being freed due to a race condition involving task sleeping and plug flush operations. The fix ensures the cached request is popped before any blocking calls to prevent the use-after-free scenario.

Detection Guidance

This vulnerability is specific to the Linux kernel's block layer (blk-mq) and does not have direct network detection methods. Detection requires checking kernel versions and examining system logs for related crashes or errors. Use commands like 'uname -a' to check kernel version and 'dmesg' or 'journalctl -k' to review kernel logs for use-after-free or blk-mq related errors.

Impact Analysis

This vulnerability could lead to system crashes, data corruption, or privilege escalation if exploited. It affects the Linux kernel's block I/O handling, potentially disrupting storage operations and causing instability in systems running vulnerable kernel versions.

Compliance Impact

The provided CVE data does not describe any direct impact on compliance with standards like GDPR or HIPAA. The vulnerability involves a use-after-free bug in the Linux kernel's block I/O subsystem, which could lead to memory corruption or crashes but does not explicitly mention data privacy or security compliance implications.

Mitigation Strategies

Update the Linux kernel to the latest patched version to resolve the use-after-free bug in blk-mq. Monitor kernel logs for crashes or unusual request handling patterns.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-64017. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart