---
id: CVE-2026-90325
title: |-
  In the Linux kernel, the following vulnerability has been resolved:

  blk-cgroup: skip dying blkg in blkcg_activate_policy()

  When switching IO schedulers on a block device, blkcg_activate_policy()
  can race with concurrent blkcg deletion,…
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  blk-cgroup: skip dying blkg in blkcg_activate_policy()

  When switching IO schedulers on a block device, blkcg_activate_policy()
  can race with concurrent blkcg deletion,…
severity: high
cvss: 7.8
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 81c1188905f88b77743d1fdeeedfc8cb7b67787d <
    b5dae1cd0d8368b4338430ff93403df67f0b8bcc
  - >-
    Linux >= bfe46d2efe46c5c952f982e2ca94fe2ec5e58e2a <
    083b58373463a6e5ee60ecb135269348f68ad7df
  - >-
    Linux >= f1c006f1c6850c14040f8337753a63119bba39b9 <
    1a267295b1ea6a6477963f3fda84adfecd48fcad
  - >-
    Linux >= f1c006f1c6850c14040f8337753a63119bba39b9 <
    7337d012ca3fc3a6a2d1c8e2a19c6d97c38b410d
  - >-
    Linux >= f1c006f1c6850c14040f8337753a63119bba39b9 <
    3d8c3da95c75a4d312e272fc7b4076dd3ba9115c
  - >-
    Linux >= f1c006f1c6850c14040f8337753a63119bba39b9 <
    d8c872901e6459339374e9eea80aa919176c2ccd
  - >-
    Linux >= f1c006f1c6850c14040f8337753a63119bba39b9 <
    5e9220389920f33b6a804d50c548cd0cd1b04634
  - Linux >= 6.1.16 < 6.1.17
  - Linux >= 6.2.3 < 6.2.4
  - Linux 6.3
published: '2026-09-17'
updated: '2026-09-18'
sourceUpdated: '2026-09-18T18:17:53.960'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-90325'
references:
  - url: 'https://git.kernel.org/stable/c/083b58373463a6e5ee60ecb135269348f68ad7df'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/1a267295b1ea6a6477963f3fda84adfecd48fcad'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/3d8c3da95c75a4d312e272fc7b4076dd3ba9115c'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/5e9220389920f33b6a804d50c548cd0cd1b04634'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/7337d012ca3fc3a6a2d1c8e2a19c6d97c38b410d'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/b5dae1cd0d8368b4338430ff93403df67f0b8bcc'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/d8c872901e6459339374e9eea80aa919176c2ccd'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
tags:
  - nvd
  - cve.org
epss: 0.00171
epssPercentile: 0.05678
ingestedAt: '2026-09-17T16:21:47.822Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

blk-cgroup: skip dying blkg in blkcg_activate_policy()

When switching IO schedulers on a block device, blkcg_activate_policy()
can race with concurrent blkcg deletion, leading to a use-after-free in
rcu_accelerate_cbs.

T1:                               T2:
                                  blkg_destroy
                                  kill(&blkg->refcnt) // blkg->refcnt=1->0
                                  blkg_release // call_rcu(__blkg_release)
                                  ...
                                  blkg_free_workfn
                                  ->pd_free_fn(pd)
elv_iosched_store
elevator_switch
...
iterate blkg list
blkg_get(blkg) // blkg->refcnt=0->1
                                  list_del_init(&blkg->q_node)
blkg_put(pinned_blkg) // blkg->refcnt=1->0
blkg_release // call_rcu again
rcu_accelerate_cbs // uaf

Fix this by checking hlist_unhashed(&blkg->blkcg_node) before getting
a reference to the blkg. This is the same check used in blkg_destroy()
to detect if a blkg has already been destroyed. If the blkg is already
unhashed, skip processing it since it's being destroyed.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.