The vulnerability in the Linux kernel blk-cgroup subsystem involves a race condition between blkcg_activate_policy() and concurrent blkcg deletion. When switching an IO scheduler, blkcg_activate_policy() allocates policy data (pd) for blkgs attached to the queue but may race with blkcg deletion, leading to use-after-free and memory leaks. Specifically, if allocation fails for one blkg after succeeding for another, rollback accesses freed memory. Additionally, freeing pd before removing the blkg from the list allows allocation of unreachable pd objects. The fix extends blkcg_mutex coverage to serialize rollback and blkg destruction, synchronizing pd lifecycle with blkg list visibility.

Successful exploitation can lead to use-after-free conditions and memory leaks in the kernel, potentially causing system instability or escalation of privileges due to corrupted kernel memory. The CVSS score of 7.8 indicates high severity with impacts on confidentiality, integrity, and availability.

The vulnerability has been resolved by extending blkcg_mutex coverage to properly serialize policy activation rollback and blkg destruction, ensuring synchronized lifecycle management of policy data. Users should apply the official kernel patches that include this fix. Patch availability is not explicitly stated in the input, so check the vendor advisory or Linux kernel mailing lists for the specific fixed kernel versions and apply updates accordingly.