{"id":"CVE-2026-90325","title":"In the Linux kernel, the following vulnerability has been resolved:\n\nblk-cgroup: skip dying blkg in blkcg_activate_policy()\n\nWhen switching IO schedulers on a block device, blkcg_activate_policy()\ncan race with concurrent blkcg deletion,…","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nblk-cgroup: skip dying blkg in blkcg_activate_policy()\n\nWhen switching IO schedulers on a block device, blkcg_activate_policy()\ncan race with concurrent blkcg deletion,…","severity":"high","cvss":7.8,"cvssVector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","vendor":"Linux","product":"Linux","affected":["Linux >= 81c1188905f88b77743d1fdeeedfc8cb7b67787d < b5dae1cd0d8368b4338430ff93403df67f0b8bcc","Linux >= bfe46d2efe46c5c952f982e2ca94fe2ec5e58e2a < 083b58373463a6e5ee60ecb135269348f68ad7df","Linux >= f1c006f1c6850c14040f8337753a63119bba39b9 < 1a267295b1ea6a6477963f3fda84adfecd48fcad","Linux >= f1c006f1c6850c14040f8337753a63119bba39b9 < 7337d012ca3fc3a6a2d1c8e2a19c6d97c38b410d","Linux >= f1c006f1c6850c14040f8337753a63119bba39b9 < 3d8c3da95c75a4d312e272fc7b4076dd3ba9115c","Linux >= f1c006f1c6850c14040f8337753a63119bba39b9 < d8c872901e6459339374e9eea80aa919176c2ccd","Linux >= f1c006f1c6850c14040f8337753a63119bba39b9 < 5e9220389920f33b6a804d50c548cd0cd1b04634","Linux >= 6.1.16 < 6.1.17","Linux >= 6.2.3 < 6.2.4","Linux 6.3"],"published":"2026-09-17","updated":"2026-09-18","sourceUpdated":"2026-09-18T18:17:53.960","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-90325","references":[{"url":"https://git.kernel.org/stable/c/083b58373463a6e5ee60ecb135269348f68ad7df","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/1a267295b1ea6a6477963f3fda84adfecd48fcad","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/3d8c3da95c75a4d312e272fc7b4076dd3ba9115c","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/5e9220389920f33b6a804d50c548cd0cd1b04634","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/7337d012ca3fc3a6a2d1c8e2a19c6d97c38b410d","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/b5dae1cd0d8368b4338430ff93403df67f0b8bcc","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/d8c872901e6459339374e9eea80aa919176c2ccd","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"tags":["nvd","cve.org"],"epss":0.00171,"epssPercentile":0.05678,"ingestedAt":"2026-09-17T16:21:47.822Z","slug":"CVE-2026-90325","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nblk-cgroup: skip dying blkg in blkcg_activate_policy()\n\nWhen switching IO schedulers on a block device, blkcg_activate_policy()\ncan race with concurrent blkcg deletion, leading to a use-after-free in\nrcu_accelerate_cbs.\n\nT1:                               T2:\n                                  blkg_destroy\n                                  kill(&blkg->refcnt) // blkg->refcnt=1->0\n                                  blkg_release // call_rcu(__blkg_release)\n                                  ...\n                                  blkg_free_workfn\n                                  ->pd_free_fn(pd)\nelv_iosched_store\nelevator_switch\n...\niterate blkg list\nblkg_get(blkg) // blkg->refcnt=0->1\n                                  list_del_init(&blkg->q_node)\nblkg_put(pinned_blkg) // blkg->refcnt=1->0\nblkg_release // call_rcu again\nrcu_accelerate_cbs // uaf\n\nFix this by checking hlist_unhashed(&blkg->blkcg_node) before getting\na reference to the blkg. This is the same check used in blkg_destroy()\nto detect if a blkg has already been destroyed. If the blkg is already\nunhashed, skip processing it since it's being destroyed.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"twilight","depthScore":43,"depthScoreParts":{"impact":42.9,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[{"seq":207257,"id":"CVE-2026-90325","ts":1789757339930,"field":"cvss","old":null,"new":"7.8"},{"seq":207256,"id":"CVE-2026-90325","ts":1789757339930,"field":"severity","old":"none","new":"high"}]}