Live › vulnerability › CVE-2026-98820
Go to dashboardIn the Linux kernel's block layer, cached requests allocated for passthrough commands can be reused for read or write I/O with the wrong scheduler flags set. For the kyber I/O scheduler this leaks a domain token and stalls the queue; the sources do not say that an attacker can trigger it.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Systems running a Linux kernel with the kyber I/O scheduler in use on block devices with blk-mq request caching. The sources do not say which kernel versions are affected or how common kyber is, so teams should check their kernel build and scheduler setting. Systems without kyber selected are likely less exposed, but the sources do not confirm this.
No product ranges from the sources yet.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
In the Linux kernel, the following vulnerability has been resolved:
blk-mq: set RQF_USE_SCHED when the operation is known
The cached requests are allocated for one operation but can be handed out for another. A passthrough command has RQF_USE_SCHED cleared, so using those flags for a subsequent read/write bio will insert it into the scheduler without ->prepare_request() and frees it without ->finish_request(). For kyber, this leaks the domain token acquired at dispatch and stalls the queue.
Don't set RQF_USE_SCHED based on the first operation the batch happened to be allocated for. Instead, set it after the request is claimed by an operation. Introduce a helper function, blk_mq_rq_late_init() for this, and absorb blk_mq_rq_time_init() since the two run together.
This page as .md · .json · in your agent: get_signal("CVE-2026-98820")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.