CVE-2026-31586

A flaw was found in the Linux kernel's block control group (blk-cgroup) component. A timing issue in the cgwb_release_workfn() function can lead to a use-after-free vulnerability. This occurs when a block control group object is prematurely released while still being referenced. A local attacker could exploit this to cause system instability or a denial of service.

A use-after-free flaw in the Linux kernel cgroup writeback and block cgroup interaction can occur when cgwb_release_workfn() drops the last reference to wb->blkcg_css before later passing the same pointer to blkcg_unpin_online(). A local attacker with access to cgroup/writeback lifecycle operations could potentially race cgroup destruction and trigger a kernel crash. The most likely impact is denial of service, while privilege escalation would require additional, unproven heap reuse control. The bug appears more consistent with a denial-of-service race condition than a reliably exploitable privilege-escalation issue, as it involves a narrow worker-thread race with no obvious attacker-controlled overwrite or reclaim primitive and currently reproduces mainly as a KASAN-detected crash.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.