The Linux kernel contained a vulnerability in the blk-cgroup component where blkcg_maybe_throttle_current() failed to release a disk reference on certain error paths. Specifically, when blkcg lookup, blkg lookup, or blkg_tryget() failed, the function jumped to an error label that only unlocked RCU but did not call put_disk() to release the disk reference acquired earlier. Since current->throttle_disk was set to NULL before the lookup, the usual cleanup in blkcg_exit() could not free the reference, causing a disk reference leak. This leak could lead to resource exhaustion affecting system stability. The fix restores the missing put_disk() call that was inadvertently removed during conversion from request_queue to gendisk.

The vulnerability causes a disk reference leak in the Linux kernel's blk-cgroup subsystem, which can lead to resource exhaustion and potentially degrade system stability or availability. There is no impact on confidentiality or integrity. The CVSS vector indicates local attack complexity with low privileges required and no user interaction, resulting in a medium severity rating.

A fix has been implemented to restore the missing disk reference release call in blkcg_maybe_throttle_current(). Users should apply the official Linux kernel updates that include this patch once available. Patch status is not yet confirmed in the provided data; check the vendor advisory for current remediation guidance.