Linux Kernel EUVD-2026-81987

Exploitation requires local access with sufficient privilege to switch a block device's IO scheduler (writing /sys/block/<dev>/queue/scheduler, which invokes blkcg_activate_policy - normally root/CAP_SYS_ADMIN) AND to trigger concurrent blkcg (block cgroup) deletion. The UAF is reachable only through the ENOMEM rollback path of blkcg_activate_policy, so the attacker must induce a policy-data allocation failure for one blkg while another blkg's blkcg is being deleted - a tight timing window. Kernels must have CONFIG_BLK_CGROUP enabled (default in most distributions) and be at an affected version prior to the fix (before 6.1.17 / 6.2.4 / 6.18.52 / 7.2.6 / 7.3-rc1). Limiting factors: no remote vector, privileged local prerequisite, and a hard-to-win race under memory pressure.

This is a locally-triggered use-after-free plus memory leak in the Linux kernel block-cgroup (blk-cgroup) layer, not a remotely exploitable flaw. The vendor CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H = 7.8) overstates real-world risk on two axes. First, the flaw is a race between blkcg_activate_policy() rollback and concurrent blkg destruction - races are inherently harder to win reliably than the AC:L rating implies (AC:H is more defensible). Second, the primary observable effect is a KASAN use-after-free access to blkg1->pd->online after the pd is freed, plus an unreachable-pd memory leak; both manifest as a kernel crash/resource exhaustion (denial of service), so the C:H/I:H confidentiality/integrity claims are not well supported - a DoS-primary C:N/I:N/A:H impact fits the description far better. There is no EPSS score, no CISA KEV listing, and no public exploit code in the provided data, so exploitation status is 'no public exploit identified.' Triggering requires local privilege to switch the IO scheduler (writing /sys/block/*/queue/scheduler, typically root) while concurrently driving blkcg deletion, further limiting practical risk. Net: a legitimate reliability/security bug worth patching, but a mid-severity local DoS in practice rather than the high-CVSS 7.8 the vendor score suggests. Note the 'Information Disclosure' tag conflicts with the actual UAF/DoS nature of the flaw.

A local user or container with the ability to change a block device's IO scheduler and manage blkcg cgroups repeatedly switches the scheduler (invoking blkcg_activate_policy) while concurrently deleting a blkcg, forcing the ENOMEM rollback path to dereference a blkg_policy_data structure that the deletion path has already freed. Winning the race yields a use-after-free that corrupts kernel memory and crashes the host, or leaks policy-data memory over repeated attempts. No public proof-of-concept is identified in the available data, and reliable exploitation depends on hitting the allocation-failure rollback window.