{"id":"CVE-2026-98820","title":"blk-mq: set RQF_USE_SCHED when the operation is known","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nblk-mq: set RQF_USE_SCHED when the operation is known\n\nThe cached requests are allocated for one operation but can be handed\nout for another. A passthrough command has …","severity":"none","vendor":"Linux","product":"Linux","affected":["Linux >= 4b6a5d9cea911424e84107df8c4eb8317938d2cd < 790730e4d95de8356a573d4b4864486bba731863","Linux >= 4b6a5d9cea911424e84107df8c4eb8317938d2cd < 2c47ebc27fa72078e26177cd458cdaf3006a9685","Linux >= 4b6a5d9cea911424e84107df8c4eb8317938d2cd < ab6c756f28c741d704a7c3e04814bfc3adf6f818","Linux 6.1"],"published":"2026-10-18","updated":"2026-10-18","sourceUpdated":"2026-10-18T15:49:12.251Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-98820","references":[{"url":"https://git.kernel.org/stable/c/790730e4d95de8356a573d4b4864486bba731863"},{"url":"https://git.kernel.org/stable/c/2c47ebc27fa72078e26177cd458cdaf3006a9685"},{"url":"https://git.kernel.org/stable/c/ab6c756f28c741d704a7c3e04814bfc3adf6f818"}],"tags":["cve.org"],"ingestedAt":"2026-10-18T16:47:32.475Z","slug":"CVE-2026-98820","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nblk-mq: set RQF_USE_SCHED when the operation is known\n\nThe cached requests are allocated for one operation but can be handed\nout for another. A passthrough command has RQF_USE_SCHED cleared, so\nusing those flags for a subsequent read/write bio will insert it into\nthe scheduler without ->prepare_request() and frees it without\n->finish_request(). For kyber, this leaks the domain token acquired at\ndispatch and stalls the queue.\n\nDon't set RQF_USE_SCHED based on the first operation the batch happened\nto be allocated for. Instead, set it after the request is claimed by an\noperation. Introduce a helper function, blk_mq_rq_late_init() for this,\nand absorb blk_mq_rq_time_init() since the two run together.\n\n## Affected\n\n- `Linux >= 4b6a5d9cea911424e84107df8c4eb8317938d2cd < 790730e4d95de8356a573d4b4864486bba731863`\n- `Linux >= 4b6a5d9cea911424e84107df8c4eb8317938d2cd < 2c47ebc27fa72078e26177cd458cdaf3006a9685`\n- `Linux >= 4b6a5d9cea911424e84107df8c4eb8317938d2cd < ab6c756f28c741d704a7c3e04814bfc3adf6f818`\n- `Linux 6.1`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":3,"depthScoreParts":{"impact":2.8,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}