CVE-2026-64017

In the Linux kernel, the following vulnerability has been resolved: blk-mq: pop cached request if it is usable When submitting a bio to blk-mq, if the task should sleep after peeking a cached request, but before it pops it, the plug flushes and calls blk_mq_free_plug_rqs, freeing the cached_rqs. This creates a use-after-free bug. Fix this by popping the cached request before any possible blocking calls if it is suitable for use. Popping this request first holds a queue reference, so avoid any serialization races with queue freezes and can safely proceed with dispatching that request to the driver. This potentially increases a timing window from when a driver wants to freeze its queue to when requests stop being dispatched. That scenario is off the fast path though, and drivers need to appropriately handle requests during a freeze request anyway. The downside is the popped element needs to be individually freed when we performed a bio plug merge. The cached request would have had to be freed later anyway, but this patch does it inline with building the plug list instead of after flushing it.

• linux linux kernel (>= 6.1.72 < 6.2) • linux linux kernel (>= 6.1.75 < 6.2) • linux linux kernel (>= 6.5.13 < 6.6) • linux linux kernel (>= 6.6.3 < 6.7) • linux linux kernel (>= 6.6.14 < 6.7) • linux linux kernel (>= 6.7.1 < 6.12.104) • linux linux kernel (>= 6.13 < 6.18.45) • linux linux kernel (>= 6.19 < 7.0.11) • linux linux kernel 6.7 • linux linux kernel 7.1