CVE-2026-90183 Linux CVE debrief

Who should care

Linux kernel developers and administrators responsible for maintaining and securing Linux-based systems should assess exposure and apply the patch or update to a fixed version. They should review system performance, adjust blk-iolatency settings as needed, and monitor for potential congestion issues. Additionally, they should ensure that the Linux kernel is updated to a version that includes the fix to prevent potential performance impacts. Affected Linux

Why it matters

Linux kernel vulnerability CVE-2026-90183 resolved in blk-iolatency. Review and apply patch or update to fixed version to prevent potential performance impact.

• Potential performance impact on Linux-based systems
• Need to review and apply patch or update to fixed version
• Possible congestion in blk_cgroup_congested()

Technical summary

The blk-iolatency vulnerability in the Linux kernel can cause blk_cgroup_congested() to return true for every task in a cgroup and its descendants. This can impact system performance when a group with no latency target of its own is throttled. The issue arises when a sibling misses its target, and check_scale_change() scales down its peers, leading to blkcg_use_delay() being called on peers with min_lat_nsec == 0. Freeing policy data leaves blkg->use_delay set and blkcg->congestion_count elevated. The fix clears the delay state when freeing policy data in iolatency_pd_free().

Defensive priority

Medium

Recommended defensive actions

• Review and apply the patch from the Linux kernel repository
• Update Linux kernel to a version that includes the fix
• Monitor system performance and adjust blk-iolatency settings as needed
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance

Evidence notes

The vulnerability is caused by blk-iolatency not clearing the delay state when freeing policy data. This issue can be triggered when a sibling misses its target, and check_scale_change() scales down its peers.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.