CVE-2026-98820
Received Received - Intake

Linux Kernel Block Layer Request Scheduling Use-After-Free

Publication date: 2026-10-18

Last updated on: 2026-10-18

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: blk-mq: set RQF_USE_SCHED when the operation is known The cached requests are allocated for one operation but can be handed out for another. A passthrough command has RQF_USE_SCHED cleared, so using those flags for a subsequent read/write bio will insert it into the scheduler without ->prepare_request() and frees it without ->finish_request(). For kyber, this leaks the domain token acquired at dispatch and stalls the queue. Don't set RQF_USE_SCHED based on the first operation the batch happened to be allocated for. Instead, set it after the request is claimed by an operation. Introduce a helper function, blk_mq_rq_late_init() for this, and absorb blk_mq_rq_time_init() since the two run together.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-18
Last Modified
2026-10-18
Generated
2026-10-18
AI Q&A
2026-10-18
EPSS Evaluated
N/A
NVD
CVE-2026-98820
EUVD
EUVD-2026-103905

Affected Vendors & Products

Showing 4 associated CPEs
Vendor Product Version / Range
Linux Linux 4b6a5d9cea911424e84107df8c4eb8317938d2cd
Linux Linux 4b6a5d9cea911424e84107df8c4eb8317938d2cd
Linux Linux 4b6a5d9cea911424e84107df8c4eb8317938d2cd
Linux Linux 6.1

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in the Linux kernel involves incorrect handling of request flags in the block layer's multi-queue (blk-mq) subsystem. When cached requests are reused for different operations, a passthrough command may clear the RQF_USE_SCHED flag. This can cause subsequent read/write operations to bypass proper scheduling, leading to resource leaks and queue stalls in the kyber I/O scheduler.

Detection Guidance

This vulnerability is specific to the Linux kernel's block I/O subsystem and requires kernel-level inspection. Detection involves checking kernel logs for related errors or verifying the presence of the vulnerable code path. Commands like dmesg, journalctl, or examining kernel source code may help identify affected systems.

Impact Analysis

This vulnerability may cause system hangs or performance degradation in I/O operations, particularly for systems using the kyber I/O scheduler. It could lead to stalled queues, resource exhaustion, or unexpected behavior in storage operations, potentially affecting system stability and responsiveness.

Mitigation Strategies

Apply the latest kernel updates from your Linux distribution to patch this vulnerability. If immediate patching is not possible, consider disabling affected I/O schedulers like kyber temporarily until the update is applied.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-98820. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart