CVE-2026-63802

{"id": "CVE-2026-63802", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.8, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 1.8}]}, "affected": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "affectedData": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "20cb1c2fb7568a6054c55defe044311397e01ddb", "lessThan": "96e545410c4f74c89d496c1d5d9ef8d08f14368b", "versionType": "git"}, {"status": "affected", "version": "20cb1c2fb7568a6054c55defe044311397e01ddb", "lessThan": "bbebd9425cad3573d1527441753899b926525a0f", "versionType": "git"}, {"status": "affected", "version": "20cb1c2fb7568a6054c55defe044311397e01ddb", "lessThan": "5e5b7f2ef854936e95dceb6a2fdfefcb7152d2c6", "versionType": "git"}, {"status": "affected", "version": "20cb1c2fb7568a6054c55defe044311397e01ddb", "lessThan": "afebe44facc48a61761e885bbb7f0380d4a603ec", "versionType": "git"}, {"status": "affected", "version": "20cb1c2fb7568a6054c55defe044311397e01ddb", "lessThan": "0ab5ee5a1badb58cbb2242617cb01a4972b1f2a2", "versionType": "git"}, {"status": "affected", "version": "0f6090d90f627d8c58f939067d6c6821ce1b3c68", "versionType": "git"}, {"status": "affected", "version": "6.3.9", "lessThan": "6.4", "versionType": "semver"}], "programFiles": ["block/blk-cgroup.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "6.4"}, {"status": "unaffected", "version": "0", "lessThan": "6.4", "versionType": "semver"}, {"status": "unaffected", "version": "6.6.144", "versionType": "semver", "lessThanOrEqual": "6.6.*"}, {"status": "unaffected", "version": "6.12.95", "versionType": "semver", "lessThanOrEqual": "6.12.*"}, {"status": "unaffected", "version": "6.18.38", "versionType": "semver", "lessThanOrEqual": "6.18.*"}, {"status": "unaffected", "version": "7.1.3", "versionType": "semver", "lessThanOrEqual": "7.1.*"}, {"status": "unaffected", "version": "7.2-rc1", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["block/blk-cgroup.c"], "defaultStatus": "affected"}]}], "published": "2026-07-19T12:16:52.847", "references": [{"url": "https://git.kernel.org/stable/c/0ab5ee5a1badb58cbb2242617cb01a4972b1f2a2", "tags": ["Patch"], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/5e5b7f2ef854936e95dceb6a2fdfefcb7152d2c6", "tags": ["Patch"], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/96e545410c4f74c89d496c1d5d9ef8d08f14368b", "tags": ["Patch"], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/afebe44facc48a61761e885bbb7f0380d4a603ec", "tags": ["Patch"], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/bbebd9425cad3573d1527441753899b926525a0f", "tags": ["Patch"], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-416"}]}], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nblk-cgroup: fix UAF in __blkcg_rstat_flush()\n\nWhen multiple blkgs in the same blkcg are released concurrently,\na use-after-free can occur. The race happens when one blkg's\n__blkcg_rstat_flush() removes another blkg's iostat entries via\nllist_del_all(). The second blkg sees an empty list and proceeds\nto free itself while the first is still iterating over its entries.\n\nMove the flush from __blkg_release() (RCU callback) to blkg_release()\n(before call_rcu). This ensures the RCU grace period waits for any\nconcurrent flush's rcu_read_lock() section to complete before freeing."}], "lastModified": "2026-07-29T20:05:01.213", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "0F0AC27C-C1AB-49CF-A549-0BF7D8370313", "versionEndExcluding": "6.4", "versionStartIncluding": "6.3.9"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "1FB20250-D599-4124-9B31-4ACBD815386B", "versionEndExcluding": "6.6.144", "versionStartIncluding": "6.4.1"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "4E206B86-E0E3-4394-A93F-39F2D50A8AA8", "versionEndExcluding": "6.12.95", "versionStartIncluding": "6.7"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "FA591B28-5D62-449E-BDBE-3C9391BF070A", "versionEndExcluding": "6.18.38", "versionStartIncluding": "6.13"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "9526B150-E2B3-4C6F-8AE5-1AF92B75AD9E", "versionEndExcluding": "7.1.3", "versionStartIncluding": "6.19"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.4:-:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "DE0B0BF6-0EEF-4FAD-927D-7A0DD77BEE75"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.4:rc7:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "1D6CAA59-F0EF-4E0B-8C23-EC9535008572"}], "operator": "OR"}]}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}