VulnerabilityPublished 18 Oct 2026

CVE-2026-98832: Linux kernel · blk-cgroup: save IRQ state in blkg_tryget_closest()

Affects Linux kernelSource CVE Database V5

Not known to be exploited : upgrade to 327c428ba79b13e4cc5253333a9d5c0aa5579bdf or 9fcf4317384ce6758c3127a6e8914c54cbb9c8cc when convenient.

Data as of 26 Oct 2026, 14:05 UTC

Severity

Medium

Rated Medium by Threat Radar's AI analysis · CVSS not yet scored by NVD

EPSS: 0.1% chance of exploitation in 30 days – higher than 4% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
Patch: Available – fixed in 327c428ba79b13e4cc5253333a9d5c0aa5579bdf, 9fcf4317384ce6758c3127a6e8914c54cbb9c8cc

Exploitation evidence

Disclosed: evidence found.
CVE published 18 Oct 2026
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors

A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 26 Oct 2026.

Disclosed: The CVE record is public on cve.org. Its publication is t = 0.
Detectable: A public nuclei template can find exposed instances, for defenders and attackers alike.
Weaponised: Public exploit code exists in Metasploit or Exploit-DB, or CISA SSVC or the CVSS exploit maturity reports a public proof of concept.
Exploited in the wild: CISA KEV lists it, CISA SSVC rates exploitation active, or a source reports attacks.
Observed by OffSeq Mirage: OffSeq Mirage honeypot sensors recorded attack traffic for this CVE, or found exposed hosts without attack traffic.

Moments are spaced evenly, not to scale; a dashed line marks a gap of six months or more. Deltas count from t = 0. Sources that give only a date (CISA KEV, Exploit-DB, or a time of exactly 00:00Z) read “same day” rather than hours. Metasploit modules carry the flaw’s disclosure date, not their release date, and nuclei templates carry no date, so both appear above but not on the timeline.

What to do

Upgrade Linux kernel to 327c428ba79b13e4cc5253333a9d5c0aa5579bdf or 9fcf4317384ce6758c3127a6e8914c54cbb9c8cc.

Affected software

Product	Affected	Fixed in
LinuxLinux	Affected ≥ 9327a865e395a53f67dffac4710beb1d4730495e, < 327c428ba79b13e4cc5253333a9d5c0aa5579bdf	Fixed in 327c428ba79b13e4cc5253333a9d5c0aa5579bdf
LinuxLinux	Affected ≥ 9327a865e395a53f67dffac4710beb1d4730495e, < 9fcf4317384ce6758c3127a6e8914c54cbb9c8cc	Fixed in 9fcf4317384ce6758c3127a6e8914c54cbb9c8cc
LinuxLinux	Affected =7.2	Fixed in–

AI-suggested

A fix for this vulnerability has been committed in the Linux kernel versions identified by commits 327c428ba79b13e4cc5253333a9d5c0aa5579bdf and 9fcf4317384ce6758c3127a6e8914c54cbb9c8cc. Users should update to a Linux kernel version that includes these commits to remediate the issue.

Description

CVE-2026-98832 is a Linux kernel vulnerability in the blk-cgroup subsystem where improper handling of interrupt state in blkg_tryget_closest() can lead to deadlocks. The issue arises because the function unconditionally enables local interrupts when releasing a spinlock, even if interrupts were previously disabled by the caller. This can cause nested lock acquisition and deadlock in certain I/O completion paths.

Impact

The vulnerability can cause deadlocks in the kernel when certain locks are held with interrupts disabled and then interrupts are re-enabled prematurely. This can lead to system hangs or degraded performance due to kernel lock contention. There is no indication of code execution or privilege escalation from this flaw.

Summary

This vulnerability involves the blk-cgroup code in the Linux kernel where blkg_tryget_closest() uses spin_lock_irq() and spin_unlock_irq() to manage q->queue_lock. If the caller has interrupts disabled, the unconditional enabling of interrupts on unlock can lead to an I/O completion softirq running on the same CPU while holding a lock, causing a deadlock. The problem was introduced after a commit moved locking into blkg_tryget_closest() and reverted to spin_lock_irq(). The fix saves and restores the caller's IRQ state to prevent this issue.

References

Community reviews

Loading reviews…

Exploitation evidence

What to do

Affected software

Description

AI analysisMachine-generated, updated 26 Oct 2026, 09:43 UTC

Technical details

References

Community reviews

Related threats