CVE-2026-64326

A flaw was found in the Linux kernel's block device handling. When a block device is unexpectedly removed, the bdev_mark_dead() function can unconditionally attempt to synchronize the device, even if it is no longer present. This can lead to a system hang, effectively causing a Denial of Service (DoS), as the system waits indefinitely for writeback operations that cannot complete. This vulnerability can be triggered by a local user or process interacting with block devices during surprise removal events.

This vulnerability is rated as Moderate because exploitation requires specific circumstances involving the sudden detachment or failure of a block device while active write operations are pending, limiting the impact to a local denial of service. The issue does not permit arbitrary code execution, privilege escalation, or direct data leakage. Additionally, earlier enterprise releases, including Red Hat Enterprise Linux 8, do not contain the vulnerable block-layer code path.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.