In the Linux kernel, the following vulnerability has been resolved: blk-mq: pop cached request if it is usable When submitting a bio to blk-mq, if… (CVE-2026-64017)
In the Linux kernel, the following vulnerability has been resolved: blk-mq: pop cached request if it is usable When submitting a bio to blk-mq, if the task should sleep after peeking a cached request, but before it pops it, the plug flushes and calls blk_mq_free_plug_rqs, freeing the cached_rqs. This creates a use-after-free bug. Fix this by popping the cached request before any possible blocking calls if it is suitable for use. Popping this request first holds a queue reference, so avoid any serialization races with queue freezes and can safely proceed with dispatching that request to the driver. This potentially increases a timing window from when a driver wants to freeze its queue to when requests stop being dispatched. That scenario is off the fast path though, and drivers need to appropriately handle requests during a freeze request anyway. The downside is the popped element needs to be individually freed when we performed a bio plug merge. The cached request would have had to be freed later anyway, but this patch does it inline with building the plug list instead of after flushing it.
AI Analysis
Technical Summary
CVE-2026-64017 describes a use-after-free vulnerability in the Linux kernel's blk-mq (block multi-queue) subsystem. When a bio is submitted, if the task needs to sleep after peeking a cached request but before popping it, the plug flushes and calls blk_mq_free_plug_rqs, which frees cached requests prematurely. This leads to a use-after-free bug. The fix pops the cached request before any blocking calls if it is suitable for use, holding a queue reference to avoid serialization races and safely dispatch the request. This approach increases the timing window for queue freezes but is considered acceptable since drivers must handle requests during freezes anyway. The popped element is freed inline during plug list building rather than after flushing.
Potential Impact
The vulnerability could lead to use-after-free conditions in the blk-mq subsystem of the Linux kernel, potentially causing system instability or crashes. No known exploits in the wild have been reported. The impact is limited to the kernel's block request handling and requires specific timing conditions to trigger.
Mitigation Recommendations
A fix for this vulnerability has been implemented in the Linux kernel. Since no specific patch links or vendor advisories are provided, users should apply the latest Linux kernel updates that include this fix. Patch status is not yet confirmed from vendor advisory; check the official Linux kernel release notes or security advisories for the exact fixed versions and updates.
In the Linux kernel, the following vulnerability has been resolved: blk-mq: pop cached request if it is usable When submitting a bio to blk-mq, if… (CVE-2026-64017)
Description
In the Linux kernel, the following vulnerability has been resolved: blk-mq: pop cached request if it is usable When submitting a bio to blk-mq, if the task should sleep after peeking a cached request, but before it pops it, the plug flushes and calls blk_mq_free_plug_rqs, freeing the cached_rqs. This creates a use-after-free bug. Fix this by popping the cached request before any possible blocking calls if it is suitable for use. Popping this request first holds a queue reference, so avoid any serialization races with queue freezes and can safely proceed with dispatching that request to the driver. This potentially increases a timing window from when a driver wants to freeze its queue to when requests stop being dispatched. That scenario is off the fast path though, and drivers need to appropriately handle requests during a freeze request anyway. The downside is the popped element needs to be individually freed when we performed a bio plug merge. The cached request would have had to be freed later anyway, but this patch does it inline with building the plug list instead of after flushing it.
CVSS v3.1
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-64017 describes a use-after-free vulnerability in the Linux kernel's blk-mq (block multi-queue) subsystem. When a bio is submitted, if the task needs to sleep after peeking a cached request but before popping it, the plug flushes and calls blk_mq_free_plug_rqs, which frees cached requests prematurely. This leads to a use-after-free bug. The fix pops the cached request before any blocking calls if it is suitable for use, holding a queue reference to avoid serialization races and safely dispatch the request. This approach increases the timing window for queue freezes but is considered acceptable since drivers must handle requests during freezes anyway. The popped element is freed inline during plug list building rather than after flushing.
Potential Impact
The vulnerability could lead to use-after-free conditions in the blk-mq subsystem of the Linux kernel, potentially causing system instability or crashes. No known exploits in the wild have been reported. The impact is limited to the kernel's block request handling and requires specific timing conditions to trigger.
Mitigation Recommendations
A fix for this vulnerability has been implemented in the Linux kernel. Since no specific patch links or vendor advisories are provided, users should apply the latest Linux kernel updates that include this fix. Patch status is not yet confirmed from vendor advisory; check the official Linux kernel release notes or security advisories for the exact fixed versions and updates.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- GHSA-pqjq-mhgh-j532
- Osv Schema Version
- 1.4.0
- Aliases
- ["CVE-2026-64017"]
- Ecosystems
- []
- Database Specific Severity
- null
- Cvss Version
- null
Threat ID: 6a5d27aa2a4a8d598912d582
Added to database: 07/19/2026, 19:38:18 UTC
Last enriched: 07/19/2026, 19:59:01 UTC
Last updated: 07/20/2026, 19:41:22 UTC
Views: 11
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.