CVE-2026-64509
Received Received - Intake

Memory Leak in Linux Kernel Rust Block Layer

Publication date: 2026-07-25

Last updated on: 2026-07-25

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: rust: block: fix GenDisk cleanup paths GenDiskBuilder::build() still has fallible work after __blk_mq_alloc_disk(), but its error path only recovers the foreign queue data. That leaks the temporary gendisk and request_queue until later teardown. If the caller moved the last Arc<TagSet<T>> into build(), the leaked queue can retain blk-mq state after the tag set is dropped. Fix the pre-registration failure path by dropping the temporary gendisk reference with put_disk() before recovering queue_data, so disk_release() can tear down the owned queue. Also pair GenDisk::drop() with put_disk() after del_gendisk(). Once a Rust GenDisk has been added with device_add_disk(), del_gendisk() only unregisters it; the final gendisk reference still has to be dropped to complete the release path.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-25
Last Modified
2026-07-25
Generated
2026-07-25
AI Q&A
2026-07-25
EPSS Evaluated
N/A
NVD
CVE-2026-64509
EUVD
EUVD-2026-48853

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
linux_kernel linux_kernel *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in the Linux kernel involves improper cleanup of GenDisk objects in Rust code. When building a GenDisk, if an error occurs after allocating a disk but before completing setup, the cleanup path fails to properly release resources. This leaks the gendisk and request_queue, potentially leaving block layer state active even after the tag set is dropped.

Detection Guidance

This vulnerability is specific to the Linux kernel's Rust block layer implementation and does not have direct network or system detection commands. It requires kernel code review or runtime analysis to identify the affected GenDisk cleanup paths. Check kernel logs for Rust block layer errors or crashes.

Impact Analysis

This could lead to resource leaks in the kernel's block layer, causing memory or object leaks. In severe cases, it might result in system instability or crashes if resources are exhausted. However, exploitation requires specific conditions and is not a direct remote attack vector.

Mitigation Strategies

Apply the latest Linux kernel patches that include the fix for this Rust block layer issue. Monitor kernel updates from your distribution and update promptly. If using custom kernels, backport the fix from upstream sources.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-64509. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart