GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2026-63802 (GCVE-0-2026-63802)

Vulnerability from cvelistv5 – Published: 2026-07-19 12:02 – Updated: 2026-08-17 04:51
VLAI
Title
blk-cgroup: fix UAF in __blkcg_rstat_flush()
Summary
In the Linux kernel, the following vulnerability has been resolved: blk-cgroup: fix UAF in __blkcg_rstat_flush() When multiple blkgs in the same blkcg are released concurrently, a use-after-free can occur. The race happens when one blkg's __blkcg_rstat_flush() removes another blkg's iostat entries via llist_del_all(). The second blkg sees an empty list and proceeds to free itself while the first is still iterating over its entries. Move the flush from __blkg_release() (RCU callback) to blkg_release() (before call_rcu). This ensures the RCU grace period waits for any concurrent flush's rcu_read_lock() section to complete before freeing.
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 20cb1c2fb7568a6054c55defe044311397e01ddb , < 96e545410c4f74c89d496c1d5d9ef8d08f14368b (git)
Affected: 20cb1c2fb7568a6054c55defe044311397e01ddb , < bbebd9425cad3573d1527441753899b926525a0f (git)
Affected: 20cb1c2fb7568a6054c55defe044311397e01ddb , < 5e5b7f2ef854936e95dceb6a2fdfefcb7152d2c6 (git)
Affected: 20cb1c2fb7568a6054c55defe044311397e01ddb , < afebe44facc48a61761e885bbb7f0380d4a603ec (git)
Affected: 20cb1c2fb7568a6054c55defe044311397e01ddb , < 0ab5ee5a1badb58cbb2242617cb01a4972b1f2a2 (git)
Affected: 0f6090d90f627d8c58f939067d6c6821ce1b3c68 (git)
Affected: 6.3.9 , < 6.4 (semver)
guessed Create a notification for this product.
Linux Linux Affected: 6.4
Unaffected: 0 , < 6.4 (semver)
Unaffected: 6.6.144 , ≤ 6.6.* (semver)
Unaffected: 6.12.95 , ≤ 6.12.* (semver)
Unaffected: 6.18.38 , ≤ 6.18.* (semver)
Unaffected: 7.1.3 , ≤ 7.1.* (semver)
Unaffected: 7.2 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "block/blk-cgroup.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "96e545410c4f74c89d496c1d5d9ef8d08f14368b",
              "status": "affected",
              "version": "20cb1c2fb7568a6054c55defe044311397e01ddb",
              "versionType": "git"
            },
            {
              "lessThan": "bbebd9425cad3573d1527441753899b926525a0f",
              "status": "affected",
              "version": "20cb1c2fb7568a6054c55defe044311397e01ddb",
              "versionType": "git"
            },
            {
              "lessThan": "5e5b7f2ef854936e95dceb6a2fdfefcb7152d2c6",
              "status": "affected",
              "version": "20cb1c2fb7568a6054c55defe044311397e01ddb",
              "versionType": "git"
            },
            {
              "lessThan": "afebe44facc48a61761e885bbb7f0380d4a603ec",
              "status": "affected",
              "version": "20cb1c2fb7568a6054c55defe044311397e01ddb",
              "versionType": "git"
            },
            {
              "lessThan": "0ab5ee5a1badb58cbb2242617cb01a4972b1f2a2",
              "status": "affected",
              "version": "20cb1c2fb7568a6054c55defe044311397e01ddb",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "0f6090d90f627d8c58f939067d6c6821ce1b3c68",
              "versionType": "git"
            },
            {
              "lessThan": "6.4",
              "status": "affected",
              "version": "6.3.9",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "block/blk-cgroup.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.4"
            },
            {
              "lessThan": "6.4",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.144",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.95",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.38",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.3",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.144",
                  "versionStartIncluding": "6.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.95",
                  "versionStartIncluding": "6.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.38",
                  "versionStartIncluding": "6.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.3",
                  "versionStartIncluding": "6.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "6.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "6.3.9",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nblk-cgroup: fix UAF in __blkcg_rstat_flush()\n\nWhen multiple blkgs in the same blkcg are released concurrently,\na use-after-free can occur. The race happens when one blkg\u0027s\n__blkcg_rstat_flush() removes another blkg\u0027s iostat entries via\nllist_del_all(). The second blkg sees an empty list and proceeds\nto free itself while the first is still iterating over its entries.\n\nMove the flush from __blkg_release() (RCU callback) to blkg_release()\n(before call_rcu). This ensures the RCU grace period waits for any\nconcurrent flush\u0027s rcu_read_lock() section to complete before freeing."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - Exploitation requires local cgroup management (rmdir on cgroupfs) and concurrent block I/O to populate per-blkcg rstat lists; the vulnerable code is in the block cgroup teardown path, not in any network protocol handler.\nAC:L - The attacker controls both sides of the race by issuing I/O on multiple block devices to create multiple blkgs with pending stats, then concurrently destroying the cgroup to trigger parallel blkg_release() calls on multiple CPUs.\nPR:L - Triggering cgroup deletion and block I/O requires only delegated cgroup write access or namespace/container root (CAP_SYS_ADMIN in a user namespace), not init-namespace root; this is routinely available in containers, Kubernetes pods, and systemd user cgroup hierarchies.\nUI:N - No victim interaction is required; the attacker programmatically performs I/O and cgroup teardown from their own process or container.\nS:U - The UAF corrupts kernel heap memory within the same kernel security domain; it does not inherently cross a VM, container, or IOMMU boundary without a separate privilege-escalation step.\nC:H - The use-after-free dereferences freed blkg structures and associated iostat data during list iteration, enabling arbitrary kernel memory read primitives typical of slab UAF bugs.\nI:H - UAF on kmalloc-allocated blkg objects allows heap grooming and write through dangling pointers, which can be leveraged for arbitrary kernel memory modification or code execution.\nA:H - Concurrent use-after-free during blkg teardown can cause immediate kernel oops/panic from accessing freed memory, and repeated triggering enables reliable denial of service."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-17T04:51:07.787Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/96e545410c4f74c89d496c1d5d9ef8d08f14368b"
        },
        {
          "url": "https://git.kernel.org/stable/c/bbebd9425cad3573d1527441753899b926525a0f"
        },
        {
          "url": "https://git.kernel.org/stable/c/5e5b7f2ef854936e95dceb6a2fdfefcb7152d2c6"
        },
        {
          "url": "https://git.kernel.org/stable/c/afebe44facc48a61761e885bbb7f0380d4a603ec"
        },
        {
          "url": "https://git.kernel.org/stable/c/0ab5ee5a1badb58cbb2242617cb01a4972b1f2a2"
        }
      ],
      "title": "blk-cgroup: fix UAF in __blkcg_rstat_flush()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-63802",
    "datePublished": "2026-07-19T12:02:08.020Z",
    "dateReserved": "2026-07-19T07:54:57.013Z",
    "dateUpdated": "2026-08-17T04:51:07.787Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-63802",
      "date": "2026-09-15",
      "epss": "0.00132",
      "percentile": "0.03122"
    },
    "microsoft_vex": {
      "current_release_date": "2026-08-14T17:54:05.000Z",
      "cve": "CVE-2026-63802",
      "id": "msrc_CVE-2026-63802",
      "initial_release_date": "2026-07-20T01:07:07.000Z",
      "product_status:fixed": "1",
      "product_status:known_affected": "1",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "blk-cgroup: fix UAF in __blkcg_rstat_flush()",
      "url": "https://msrc.microsoft.com/csaf/vex/2026/msrc_cve-2026-63802.json",
      "version": "6"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-63802\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2026-07-19T12:16:52.847\",\"lastModified\":\"2026-08-17T05:17:16.727\",\"vulnStatus\":\"Analyzed\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nblk-cgroup: fix UAF in __blkcg_rstat_flush()\\n\\nWhen multiple blkgs in the same blkcg are released concurrently,\\na use-after-free can occur. The race happens when one blkg\u0027s\\n__blkcg_rstat_flush() removes another blkg\u0027s iostat entries via\\nllist_del_all(). The second blkg sees an empty list and proceeds\\nto free itself while the first is still iterating over its entries.\\n\\nMove the flush from __blkg_release() (RCU callback) to blkg_release()\\n(before call_rcu). This ensures the RCU grace period waits for any\\nconcurrent flush\u0027s rcu_read_lock() section to complete before freeing.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"block/blk-cgroup.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"20cb1c2fb7568a6054c55defe044311397e01ddb\",\"lessThan\":\"96e545410c4f74c89d496c1d5d9ef8d08f14368b\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"20cb1c2fb7568a6054c55defe044311397e01ddb\",\"lessThan\":\"bbebd9425cad3573d1527441753899b926525a0f\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"20cb1c2fb7568a6054c55defe044311397e01ddb\",\"lessThan\":\"5e5b7f2ef854936e95dceb6a2fdfefcb7152d2c6\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"20cb1c2fb7568a6054c55defe044311397e01ddb\",\"lessThan\":\"afebe44facc48a61761e885bbb7f0380d4a603ec\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"20cb1c2fb7568a6054c55defe044311397e01ddb\",\"lessThan\":\"0ab5ee5a1badb58cbb2242617cb01a4972b1f2a2\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"0f6090d90f627d8c58f939067d6c6821ce1b3c68\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"6.3.9\",\"lessThan\":\"6.4\",\"versionType\":\"semver\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"block/blk-cgroup.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"6.4\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"6.4\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.6.144\",\"lessThanOrEqual\":\"6.6.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.12.95\",\"lessThanOrEqual\":\"6.12.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.18.38\",\"lessThanOrEqual\":\"6.18.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.1.3\",\"lessThanOrEqual\":\"7.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.2\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-416\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.3.9\",\"versionEndExcluding\":\"6.4\",\"matchCriteriaId\":\"0F0AC27C-C1AB-49CF-A549-0BF7D8370313\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.4.1\",\"versionEndExcluding\":\"6.6.144\",\"matchCriteriaId\":\"1FB20250-D599-4124-9B31-4ACBD815386B\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.7\",\"versionEndExcluding\":\"6.12.95\",\"matchCriteriaId\":\"4E206B86-E0E3-4394-A93F-39F2D50A8AA8\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.13\",\"versionEndExcluding\":\"6.18.38\",\"matchCriteriaId\":\"FA591B28-5D62-449E-BDBE-3C9391BF070A\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.19\",\"versionEndExcluding\":\"7.1.3\",\"matchCriteriaId\":\"9526B150-E2B3-4C6F-8AE5-1AF92B75AD9E\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.4:-:*:*:*:*:*:*\",\"matchCriteriaId\":\"DE0B0BF6-0EEF-4FAD-927D-7A0DD77BEE75\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.4:rc7:*:*:*:*:*:*\",\"matchCriteriaId\":\"1D6CAA59-F0EF-4E0B-8C23-EC9535008572\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/0ab5ee5a1badb58cbb2242617cb01a4972b1f2a2\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/5e5b7f2ef854936e95dceb6a2fdfefcb7152d2c6\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/96e545410c4f74c89d496c1d5d9ef8d08f14368b\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/afebe44facc48a61761e885bbb7f0380d4a603ec\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/bbebd9425cad3573d1527441753899b926525a0f\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-09-15T05:30:01+00:00",
      "cve": "CVE-2026-63802",
      "id": "CVE-2026-63802",
      "initial_release_date": "2026-07-19T00:00:00+00:00",
      "product_status:fixed": "150",
      "product_status:known_affected": "198",
      "product_status:known_not_affected": "28",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: blk-cgroup: fix UAF in __blkcg_rstat_flush()",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-63802.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "important",
      "current_release_date": "2026-09-16T00:08:59Z",
      "cve": "CVE-2026-63802",
      "id": "CVE-2026-63802",
      "initial_release_date": "2026-07-19T17:35:03Z",
      "product_status:first_fixed": "2",
      "product_status:known_affected": "423",
      "product_status:known_not_affected": "251",
      "product_status:recommended": "305",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-63802",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-63802.json",
      "version": "20"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.