Skip to main content

Linux Kernel EUVDEUVD-2026-45590

| CVE-2026-64017 HIGH
2026-07-19 Linux GHSA-pqjq-mhgh-j532
Information Disclosure Linux
7.8
CVSS 3.1 · Vendor: Linux
Share

Severity by source

Vendor (Linux) PRIMARY
7.8 HIGH
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
vuln.today AI
7.0 HIGH

Local unprivileged block I/O suffices (AV:L, PR:L), but success requires winning a narrow peek/pop scheduling race, so AC:H; kernel memory corruption yields full C/I/A impact.

3.1 AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
4.0 AV:L/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
SUSE
HIGH
qualitative
Red Hat
7.0 HIGH
qualitative

Primary rating from Vendor (Linux).

CVSS VectorVendor: Linux

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

5
Analysis Generated
Jul 20, 2026 - 16:52 vuln.today
CVSS changed
Jul 20, 2026 - 15:22 NVD
7.8 (HIGH)
Patch available
Jul 19, 2026 - 17:03 EUVD
CVE Published
Jul 19, 2026 - 15:39 cve.org
HIGH 7.8
CVE Published
Jul 19, 2026 - 15:39 cve.org
UNKNOWN (no severity yet)

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

blk-mq: pop cached request if it is usable

When submitting a bio to blk-mq, if the task should sleep after peeking a cached request, but before it pops it, the plug flushes and calls blk_mq_free_plug_rqs, freeing the cached_rqs. This creates a use-after-free bug. Fix this by popping the cached request before any possible blocking calls if it is suitable for use.

Popping this request first holds a queue reference, so avoid any serialization races with queue freezes and can safely proceed with dispatching that request to the driver. This potentially increases a timing window from when a driver wants to freeze its queue to when requests stop being dispatched. That scenario is off the fast path though, and drivers need to appropriately handle requests during a freeze request anyway.

The downside is the popped element needs to be individually freed when we performed a bio plug merge. The cached request would have had to be freed later anyway, but this patch does it inline with building the plug list instead of after flushing it.

AnalysisAI

Local privilege-escalation-class memory corruption in the Linux kernel's blk-mq multi-queue block layer allows a local low-privileged user to trigger a use-after-free when submitting a bio: if the task sleeps after peeking a cached request but before popping it, the plug flush frees the cached_rqs, leaving a dangling pointer. The flaw affects mainline and multiple stable trees (6.1.x, 6.5.x, 6.6.x, 6.7) and carries CVSS 7.8 (high CIA impact). There is no public exploit identified at time of analysis, and the very low EPSS (0.15%, 5th percentile) reflects the difficulty of winning the required timing race rather than low structural severity.

Technical ContextAI

The vulnerability lives in the Linux block multi-queue (blk-mq) submission path, specifically the plug-based request caching optimization used to batch block I/O. When a bio is submitted, blk-mq may peek a request from the per-task plug cache (cached_rqs) before committing to it. If the submitting task blocks between peeking and popping that request, blk_mq_free_plug_rqs runs during the plug flush and frees the cached request pool, so the subsequent pop operates on freed memory. This is a classic CWE-416 Use-After-Free driven by a race/timing window (the CWE field is listed as N/A in the source, but the described free-then-reuse pattern is textbook UAF). The fix pops the usable cached request before any potentially blocking call, which also holds a queue reference and avoids serialization races with queue freezes; the trade-off is that a plug-merged request must now be freed inline. CPE data identifies the affected component simply as cpe:2.3:a:linux:linux, i.e. the kernel itself, deployed across essentially all Linux distributions.

RemediationAI

Upstream fix available (stable commits 388468f7e7d1 and dc278e9bf2b9, not a single tagged upstream release), so update to a distribution kernel that has backported these blk-mq patches - apply your distro's latest 6.1.y, 6.6.y, or 6.7+ kernel update and reboot. Reference the fix commits at https://git.kernel.org/stable/c/388468f7e7d1eab092cf2a39fdfb502e52019ec6 and https://git.kernel.org/stable/c/dc278e9bf2b9513a763353e6b9cc21e0f532954e, and monitor your vendor's security tracker (RHSA/USN/SUSE-SU) for the packaged version, which was not enumerated in the provided data. There is no clean feature-flag workaround because plug-based request caching is core to the blk-mq fast path and cannot be disabled without disrupting normal block I/O; the meaningful compensating control is to reduce exposure to untrusted local code - restrict local shell/container access on multi-tenant hosts, and where feasible tighten sandboxing (seccomp/namespaces) around low-trust workloads that issue block I/O. These controls reduce who can attempt the race but do not close the bug, so they are stopgaps pending the kernel update.

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Important
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 16.0 Affected

Share

EUVD-2026-45590 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy