CVE-2026-64017blk-mq: pop cached request if it is usable
Updated under an hour ago ()
Does this affect you?
It affects Linux and 1 other product. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: blk-mq: pop cached request if it is usable When submitting a bio to blk-mq, if the task should sleep after peeking a cached request, but before it pops it, the plug flushes and calls blk_mq_free_plug_rqs, freeing the cached_rqs. This creates a use-after-free bug. Fix this by popping the cached request before any possible blocking calls if it is suitable for use. Popping this request first holds a queue reference, so avoid any serialization races with queue freezes and can safely proceed with dispatching that request to the driver. This potentially increases a timing window from when a driver wants to freeze its queue to when requests stop being dispatched. That scenario is off the fast path though, and drivers need to appropriately handle requests during a freeze request anyway. The downside is the popped element needs to be individually freed when we performed a bio plug merge. The cached request would have had to be freed later anyway, but this patch does it inline with building the plug list instead of after flushing it.
- CVSS
- 7.8 HIGH (v3.1, CNA)CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Linux
- NVD analysis
- Analyzed
- Record last updated
- Oct 16, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Linux Linux linux:linux (from the name) | from b0077e269f6c152e807fdac90b58caf012cdbaab before 23d8ea1e303b5f32d883757a4a707e791dbc9808; from b0077e269f6c152e807fdac90b58caf012cdbaab before 97e2d08de282ef76f84ab4ccd00f1acb3f5f999e; from b0077e269f6c152e807fdac90b58caf012cdbaab before 388468f7e7d1eab092cf2a39fdfb502e52019ec6; from b0077e269f6c152e807fdac90b58caf012cdbaab before dc278e9bf2b9513a763353e6b9cc21e0f532954e; b5c8e0ff76d10f6bf70a7237678f27c20cf59bc9; e9c309ded295b7f8849097d71ae231456ca79f78; b80056bd75a16e4550873ecefe12bc8fd190b1cf; 33cf52b6e53a6aa55883aa7fb9ceffceff8488a6; and 6 more ranges | CNA record |
linux linux_kernel linux:linux_kernel | from 6.1.72 before 6.2; from 6.1.75 before 6.2; from 6.5.13 before 6.6; from 6.6.3 before 6.7; from 6.6.14 before 6.7; from 6.7.1 before 6.12.104; from 6.13 before 6.18.45; from 6.19 before 7.0.11; and 12 more ranges | NVD |
References
- https://git.kernel.org/stable/c/23d8ea1e303b5f32d883757a4a707e791dbc9808patch
- https://git.kernel.org/stable/c/97e2d08de282ef76f84ab4ccd00f1acb3f5f999epatch
- https://git.kernel.org/stable/c/388468f7e7d1eab092cf2a39fdfb502e52019ec6patch
- https://git.kernel.org/stable/c/dc278e9bf2b9513a763353e6b9cc21e0f532954epatch
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.