CVE-2026-90325 Linux CVE debrief

Who should care

Linux kernel maintainers, users, and administrators should assess exposure and verify patched versions to prevent potential use-after-free issues. This includes reviewing Linux kernel versions and configurations, monitoring system logs, and applying updates as needed. The vulnerability affects the blk-cgroup component of the Linux kernel, which is critical for managing block devices and IO schedulers.

Why it matters

A use-after-free vulnerability in the Linux kernel's blk-cgroup requires verification of patched versions and monitoring of system logs to prevent potential issues.

• Verify patched Linux kernel versions to prevent use-after-free issues
• Monitor system logs for suspicious activity related to blk-cgroup and IO schedulers
• Assess exposure and apply updates as needed

Technical summary

The Linux kernel's blk-cgroup has a use-after-free vulnerability when switching IO schedulers on a block device. This occurs because blkcg_activate_policy() can race with concurrent blkcg deletion, leading to a use-after-free in rcu_accelerate_cbs. The issue is resolved by checking hlist_unhashed(&blkg->blkcg_node) before getting a reference to the blkg. This check prevents the use-after-free by skipping already unhashed blkg instances during processing. The fix ensures that the blkg is not accessed after it has been destroyed.

Defensive priority

Linux kernel maintainers and users should assess exposure and verify patched versions.

Recommended defensive actions

• Review Linux kernel versions and configurations for potential exposure
• Verify patched versions and apply updates as needed
• Monitor system logs for suspicious activity related to blk-cgroup and IO schedulers
• Assess exposure and apply updates as needed
• Verify the integrity of the Linux kernel versions in use
• Check for any signs of exploitation in system logs
• Consider implementing compensating controls for exposed systems

Evidence notes

The CVE record and NVD entry provide details on the vulnerability. However, the scope of affected versions and potential impact require further verification from official Linux kernel sources. The issue is related to the blk-cgroup and IO schedulers in the Linux kernel. The fix is based on checking the blkg->blkcg_node before processing it.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.