CVE-2026-63802

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-63802
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-63802.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-63802
Downstream
BELL (1)
DEBIAN (1)
MGASA (1)
OESA (1)
openSUSE (2)
RHSA (5)
RLSA (3)
SUSE (127)
UBUNTU (1)
Related
ALSA (4)
openSUSE (2)
SUSE (127)
Published
2026-07-19T12:02:08Z
Modified
2026-10-17T02:30:26Z
Severity
  • 7.8 (High) CVSS_V3 - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
Summary
blk-cgroup: fix UAF in __blkcg_rstat_flush()
Details

In the Linux kernel, the following vulnerability has been resolved:

blk-cgroup: fix UAF in __blkcg_rstat_flush()

When multiple blkgs in the same blkcg are released concurrently, a use-after-free can occur. The race happens when one blkg's __blkcg_rstat_flush() removes another blkg's iostat entries via llist_del_all(). The second blkg sees an empty list and proceeds to free itself while the first is still iterating over its entries.

Move the flush from __blkg_release() (RCU callback) to blkg_release() (before call_rcu). This ensures the RCU grace period waits for any concurrent flush's rcu_read_lock() section to complete before freeing.

Database specific 
{
    "cna_assigner":  "Linux",
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/63xxx/CVE-2026-63802.json"
}
References

Affected packages

Git / git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git

Affected ranges

Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
20cb1c2fb7568a6054c55defe044311397e01ddb
Fixed
96e545410c4f74c89d496c1d5d9ef8d08f14368b
Fixed
bbebd9425cad3573d1527441753899b926525a0f
Fixed
5e5b7f2ef854936e95dceb6a2fdfefcb7152d2c6
Fixed
afebe44facc48a61761e885bbb7f0380d4a603ec
Fixed
0ab5ee5a1badb58cbb2242617cb01a4972b1f2a2
Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
6.3.9
Fixed
6.4
Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
0f6090d90f627d8c58f939067d6c6821ce1b3c68

Affected versions

v6.*
v6.3.10
v6.3.11
v6.3.12
v6.3.13
v6.3.9

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-63802.json"

Linux / Kernel

Package

Name
Kernel

Affected ranges

Type
ECOSYSTEM
Events
Introduced
6.4.0
Fixed
6.6.144
Type
ECOSYSTEM
Events
Introduced
6.7.0
Fixed
6.12.95
Type
ECOSYSTEM
Events
Introduced
6.13.0
Fixed
6.18.38
Type
ECOSYSTEM
Events
Introduced
6.19.0
Fixed
7.1.3

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-63802.json"