CVE-2026-90325

A flaw was found in the Linux kernel's blk-cgroup component. This vulnerability arises from a race condition that occurs when input/output (IO) schedulers are switched on a block device simultaneously with the deletion of a blk-cgroup. This timing issue can lead to a use-after-free error, which may result in system instability or a denial of service.

A race in blk-cgroup can occur when blkcg_activate_policy() walks blkgs while a concurrent blkcg deletion is destroying the same blkg. The dying object can be referenced again after its refcount reached zero, which can lead to a second release path and a use-after-free in rcu_accelerate_cbs. For the CVSS the PR:L value is used for the paranoid score because some deployments delegate cgroup or block control operations to local service accounts or container management components rather than only full host root. The issue is local and not directly network reachable. Impact is at least denial of service via kernel crash. Because this is a kernel UAF in an RCU and refcount lifecycle path, worst case impact may include confidentiality and integrity compromise and should be reviewed manually.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.