The Linux kernel blk-cgroup subsystem had a use-after-free vulnerability in the __blkcg_rstat_flush() function. When multiple blkgs in the same blkcg are released concurrently, a race condition occurs: one blkg's flush removes another blkg's iostat entries, causing the second blkg to see an empty list and free itself while the first is still iterating. The fix moves the flush from the RCU callback __blkg_release() to blkg_release() before call_rcu, ensuring the RCU grace period waits for any concurrent flush's rcu_read_lock() to complete before freeing memory.

This vulnerability could lead to use-after-free conditions in the kernel, potentially causing system instability or crashes. No known exploits in the wild have been reported. The impact is limited to concurrent release scenarios within blk-cgroup and may affect kernel reliability or security depending on exploitation context.

A fix has been implemented in the Linux kernel by changing the timing of the flush operation to ensure proper synchronization with RCU grace periods. Users should update to the fixed kernel version once available. Patch status is not yet confirmed from the vendor advisory; check the official Linux kernel advisories or distribution updates for the fixed version and apply updates accordingly.