CVE-2026-64326
Received Received - Intake

Kernel Deadlock in NVMe Device Due to Block Sync on Surprise Removal

Publication date: 2026-07-25

Last updated on: 2026-07-25

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: block: skip sync_blockdev() on surprise removal in bdev_mark_dead() bdev_mark_dead()'s @surprise == true means the device is already gone. The filesystem callback fs_bdev_mark_dead() honours this and skips sync_filesystem(), but the bare block device path (no ->mark_dead op) lost its !surprise guard when the holder ->mark_dead callback was wired up (see Fixes), and now calls sync_blockdev() unconditionally, which can hang forever waiting on writeback that can no longer complete. syzkaller hit this via nvme_reset_work()'s "I/O queues lost" path: nvme_mark_namespaces_dead() -> blk_mark_disk_dead() -> bdev_mark_dead(bdev, true) -> sync_blockdev() blocks in folio_wait_writeback(), wedging the reset worker and every task waiting on it. Skip the sync on surprise removal, matching fs_bdev_mark_dead(); invalidate_bdev() still runs. Orderly removal (surprise == false) is unchanged. Found by FuzzNvme(Syzkaller with FEMU fuzzing framework).

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-25
Last Modified
2026-07-25
Generated
2026-07-25
AI Q&A
2026-07-25
EPSS Evaluated
N/A
NVD
CVE-2026-64326
EUVD
EUVD-2026-48870

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
linux linux_kernel *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in the Linux kernel occurs when a block device is unexpectedly removed. The function bdev_mark_dead() is called with a flag indicating surprise removal, but the block device path fails to skip sync_blockdev() in this case. This causes the system to hang indefinitely while waiting for writeback operations that can never complete.

Detection Guidance

This vulnerability is specific to the Linux kernel and involves a deadlock during device removal. Detection requires checking kernel logs for hangs during NVMe or block device operations. Monitor for tasks stuck in 'D' state (uninterruptible sleep) using 'ps aux | grep D' or 'top'. Check for kernel warnings with 'dmesg | grep -i nvme' or 'dmesg | grep -i block'.

Impact Analysis

This vulnerability can cause system hangs or crashes when a block device like NVMe storage is unexpectedly removed. It may lead to unresponsive systems, failed operations, or forced reboots, disrupting normal operations and potentially causing data loss.

Mitigation Strategies

Upgrade the Linux kernel to a patched version where this issue is resolved. Avoid surprise removal of NVMe or block devices during active I/O operations. If using NVMe, ensure proper error handling in reset paths. Monitor kernel updates from your distribution.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-64326. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart