---
id: CVE-2026-98820
title: 'blk-mq: set RQF_USE_SCHED when the operation is known'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  blk-mq: set RQF_USE_SCHED when the operation is known

  The cached requests are allocated for one operation but can be handed
  out for another. A passthrough command has …
severity: none
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 4b6a5d9cea911424e84107df8c4eb8317938d2cd <
    790730e4d95de8356a573d4b4864486bba731863
  - >-
    Linux >= 4b6a5d9cea911424e84107df8c4eb8317938d2cd <
    2c47ebc27fa72078e26177cd458cdaf3006a9685
  - >-
    Linux >= 4b6a5d9cea911424e84107df8c4eb8317938d2cd <
    ab6c756f28c741d704a7c3e04814bfc3adf6f818
  - Linux 6.1
published: '2026-10-18'
updated: '2026-10-18'
sourceUpdated: '2026-10-18T15:49:12.251Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-98820'
references:
  - url: 'https://git.kernel.org/stable/c/790730e4d95de8356a573d4b4864486bba731863'
  - url: 'https://git.kernel.org/stable/c/2c47ebc27fa72078e26177cd458cdaf3006a9685'
  - url: 'https://git.kernel.org/stable/c/ab6c756f28c741d704a7c3e04814bfc3adf6f818'
tags:
  - cve.org
ingestedAt: '2026-10-18T16:47:32.475Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

blk-mq: set RQF_USE_SCHED when the operation is known

The cached requests are allocated for one operation but can be handed
out for another. A passthrough command has RQF_USE_SCHED cleared, so
using those flags for a subsequent read/write bio will insert it into
the scheduler without ->prepare_request() and frees it without
->finish_request(). For kyber, this leaks the domain token acquired at
dispatch and stalls the queue.

Don't set RQF_USE_SCHED based on the first operation the batch happened
to be allocated for. Instead, set it after the request is claimed by an
operation. Introduce a helper function, blk_mq_rq_late_init() for this,
and absorb blk_mq_rq_time_init() since the two run together.

## Affected

- `Linux >= 4b6a5d9cea911424e84107df8c4eb8317938d2cd < 790730e4d95de8356a573d4b4864486bba731863`
- `Linux >= 4b6a5d9cea911424e84107df8c4eb8317938d2cd < 2c47ebc27fa72078e26177cd458cdaf3006a9685`
- `Linux >= 4b6a5d9cea911424e84107df8c4eb8317938d2cd < ab6c756f28c741d704a7c3e04814bfc3adf6f818`
- `Linux 6.1`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.