Linux Kernel EUVD-2026-45468

The bug lives in the block layer's cgroup accounting path (block/blk-cgroup.c). Each block cgroup (blkg) maintains per-CPU I/O statistics that are aggregated via a lockless list (llist) during rstat flush. When a blkg is torn down, __blkcg_rstat_flush() calls llist_del_all() to drain iostat entries. The race: two blkgs in the same blkcg are released concurrently, and one blkg's flush drains the other blkg's iostat entries; the second blkg then observes an empty list and frees itself while the first is still iterating those entries - a classic use-after-free (CWE-416). The root cause is that the flush was invoked from __blkg_release(), an RCU callback, so the RCU grace period did not serialize against a concurrent flush's rcu_read_lock() critical section. The fix moves the flush into blkg_release() before call_rcu(), ensuring the grace period waits for concurrent readers to finish before memory is freed. CPE data identifies the affected product generically as cpe:2.3:a:linux:linux, i.e., the mainline/stable Linux kernel.