CVE-2026-98820blk-mq: set RQF_USE_SCHED when the operation is known
Updated under an hour ago ()
Does this affect you?
It affects Linux. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: blk-mq: set RQF_USE_SCHED when the operation is known The cached requests are allocated for one operation but can be handed out for another. A passthrough command has RQF_USE_SCHED cleared, so using those flags for a subsequent read/write bio will insert it into the scheduler without ->prepare_request() and frees it without ->finish_request(). For kyber, this leaks the domain token acquired at dispatch and stalls the queue. Don't set RQF_USE_SCHED based on the first operation the batch happened to be allocated for. Instead, set it after the request is claimed by an operation. Introduce a helper function, blk_mq_rq_late_init() for this, and absorb blk_mq_rq_time_init() since the two run together.
- CVSS
- Not yet scored
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Linux
- NVD analysis
- Received
- Record last updated
- Oct 18, 2026
- First seen by InfoSec Signals
- Oct 18, 2026
Affected products
Linux Linux linux:linux (from the name) | from 4b6a5d9cea911424e84107df8c4eb8317938d2cd before 790730e4d95de8356a573d4b4864486bba731863; 4b6a5d9cea911424e84107df8c4eb8317938d2cd builds before 2c47ebc27fa72078e26177cd458cdaf3006a9685; from 4b6a5d9cea911424e84107df8c4eb8317938d2cd before ab6c756f28c741d704a7c3e04814bfc3adf6f818 | CNA record |
References
- https://git.kernel.org/stable/c/790730e4d95de8356a573d4b4864486bba731863
- https://git.kernel.org/stable/c/2c47ebc27fa72078e26177cd458cdaf3006a9685
- https://git.kernel.org/stable/c/ab6c756f28c741d704a7c3e04814bfc3adf6f818
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.