Skip to main content

Linux Kernel EUVDEUVD-2026-38994

| CVE-2026-53126 MEDIUM
2026-06-24 Linux GHSA-2mp2-fxxh-hv2j
Information Disclosure Linux Red Hat Suse
5.5
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
5.5 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
vuln.today AI
5.5 MEDIUM

Local access and low privilege required to interact with blk-cgroup paths; no confidentiality or integrity impact; gradual availability loss from kernel resource exhaustion.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE
MEDIUM
qualitative
Red Hat
5.5 LOW
qualitative

Primary rating from NVD.

CVSS VectorNVD

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Lifecycle Timeline

5
Analysis Generated
Jul 23, 2026 - 21:12 vuln.today
CVSS changed
Jul 23, 2026 - 21:07 NVD
5.5 (MEDIUM)
Patch available
Jun 24, 2026 - 18:02 EUVD
CVE Published
Jun 24, 2026 - 16:30 nvd
MEDIUM 5.5
CVE Published
Jun 24, 2026 - 16:30 cve.org
UNKNOWN (no severity yet)

DescriptionNVD

In the Linux kernel, the following vulnerability has been resolved:

blk-cgroup: fix disk reference leak in blkcg_maybe_throttle_current()

Add the missing put_disk() on the error path in blkcg_maybe_throttle_current(). When blkcg lookup, blkg lookup, or blkg_tryget() fails, the function jumps to the out label which only calls rcu_read_unlock() but does not release the disk reference acquired by blkcg_schedule_throttle() via get_device(). Since current->throttle_disk is already set to NULL before the lookup, blkcg_exit() cannot release this reference either, causing the disk to never be freed.

Restore the reference release that was present as blk_put_queue() in the original code but was inadvertently dropped during the conversion from request_queue to gendisk.

AnalysisAI

Reference leak in the Linux kernel blk-cgroup subsystem allows a local low-privileged user to cause kernel disk object memory exhaustion, potentially leading to system instability or denial of service. The flaw exists in blkcg_maybe_throttle_current() since kernel 6.3, where a missing put_disk() call on error paths leaves disk references permanently unreleased. No public exploit exists and EPSS at 0.16% (5th percentile) indicates negligible exploitation probability; patches are available across multiple stable branches.

Technical ContextAI

The vulnerability resides in the block I/O cgroup (blk-cgroup) subsystem of the Linux kernel, specifically in blkcg_maybe_throttle_current(). This function is part of the I/O scheduling and throttling path that controls per-cgroup disk access rates. The bug is a classic resource management flaw: the function acquires a disk reference via get_device() through blkcg_schedule_throttle() setting current->throttle_disk, but then sets current->throttle_disk to NULL before performing blkcg/blkg lookups. If any of these lookups fail (blkcg lookup, blkg lookup, or blkg_tryget()), execution jumps to the 'out' label which only calls rcu_read_unlock() - the disk reference from get_device() is never released. Because throttle_disk is already NULL, the cleanup function blkcg_exit() also cannot free the reference, creating a permanent leak. The regression was introduced during a refactoring that converted the code from request_queue to gendisk abstractions, where the original blk_put_queue() equivalent was inadvertently dropped. CPE: cpe:2.3:a:linux:linux:*:*:*:*:*:*:*:*. No CWE was formally assigned, though this maps to CWE-772 (Missing Release of Resource after Effective Lifetime).

RemediationAI

Update to a patched kernel version: 6.6.141, 6.12.91, 6.18.33, 7.0.10, or 7.1, depending on the stable branch in use. Upstream fixes are available as stable commits at https://git.kernel.org/stable/c/4048ed98860d3785645ebbd34f69566a6c7320c3, https://git.kernel.org/stable/c/73a5af059905d171b398c8b2381632ee499948b5, https://git.kernel.org/stable/c/b3e005f16cd98f815429a87aef4c61e9c140779f, https://git.kernel.org/stable/c/000e8454692cab9d1f1b80130e2870e355301d06, and https://git.kernel.org/stable/c/23308af722fefed00af5f238024c11710938fba3. Ubuntu users should apply updates per USN-8568-1, USN-8567-1, and USN-8566-1 at https://ubuntu.com/security/notices/. If patching is not immediately possible, restricting local user access to cgroup-managed I/O environments reduces exposure, but is not a complete mitigation since the leak only manifests when blkcg/blkg error paths are hit - a condition that may occur independently of direct user action under memory pressure.

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 16.0 Affected

Share

EUVD-2026-38994 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy