{"id":"CVE-2026-98820","kind":"vulnerability","aliases":["CVE-2026-98820"],"related":[],"title":"Linux kernel: block layer request flags can stall the kyber I/O queue","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nblk-mq: set RQF_USE_SCHED when the operation is known\n\nThe cached requests are allocated for one operation but can be handed\nout for another. A passthrough command has RQF_USE_SCHED cleared, so\nusing those flags for a subsequent read/write bio will insert it into\nthe scheduler without ->prepare_request() and frees it without\n->finish_request(). For kyber, this leaks the domain token acquired at\ndispatch and stalls the queue.\n\nDon't set RQF_USE_SCHED based on the first operation the batch happened\nto be allocated for. Instead, set it after the request is claimed by an\noperation. Introduce a helper function, blk_mq_rq_late_init() for this,\nand absorb blk_mq_rq_time_init() since the two run together.","summary":"In the Linux kernel's block layer, cached requests allocated for passthrough commands can be reused for read or write I/O with the wrong scheduler flags set. For the kyber I/O scheduler this leaks a domain token and stalls the queue; the sources do not say that an attacker can trigger it.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["block-devices","infrastructure","linux-kernel","self-hosted"],"not_affected_if":["kyber-not-in-use"],"how_to_check":"- unknown","fix":"- Move to a kernel release that includes the upstream commit titled 'blk-mq: set RQF_USE_SCHED when the operation is known' (the sources do not name a version).","status":"open","published_at":"2026-10-18T16:17:36+00:00","first_seen_at":"2026-10-23T21:57:17+00:00","triaged_at":"2026-10-25T05:14:44+00:00","updated_at":"2026-10-25T05:14:44+00:00","category":"infrastructure","confidence":0.5,"triage":{"at":"2026-10-25T05:14:44Z","model":"claude-haiku-5-5","output":{"fix":"- Move to a kernel release that includes the upstream commit titled 'blk-mq: set RQF_USE_SCHED when the operation is known' (the sources do not name a version).","reach":"local","title":"Linux kernel: block layer request flags can stall the kyber I/O queue","impact":"low","summary":"In the Linux kernel's block layer, cached requests allocated for passthrough commands can be reused for read or write I/O with the wrong scheduler flags set. For the kyber I/O scheduler this leaks a domain token and stalls the queue; the sources do not say that an attacker can trigger it.","category":"infrastructure","nicknames":[],"who_cares":["linux-kernel","self-hosted","block-devices"],"confidence":0.5,"needs_auth":"unknown","worst_case":"I/O queue stalls, denying service to block device users","analyst_note":"Find the affected kernel version range and fixed release from the NVD entry or the upstream kernel stable commit; confirm how kyber is selected by default.","how_to_check":"- unknown","needs_analyst":true,"not_affected_if":["kyber-not-in-use"],"who_is_affected":"Systems running a Linux kernel with the kyber I/O scheduler in use on block devices with blk-mq request caching. The sources do not say which kernel versions are affected or how common kyber is, so teams should check their kernel build and scheduler setting. Systems without kyber selected are likely less exposed, but the sources do not confirm this.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"unknown"},"cost_usd":0.000621,"input_tokens":3494,"output_tokens":544,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':14A,17A '-98820':15A,18A 'absorb':204C 'acquir':156C 'alloc':38B,106C,179C 'anoth':116C 'attack':77B 'base':169C 'batch':175C 'bio':133C 'blk':91C,196C,205C 'blk-mq':90C 'block':3A,20B,34B 'block-devic':19B 'cach':36B,103C 'claim':188C 'clear':124C 'command':41B,119C 'cve':13A,16A 'devic':21B 'dispatch':158C 'domain':64B,154C 'finish':147C 'first':172C 'flag':6A,54B,128C 'follow':85C 'free':144C 'function':195C 'hand':113C 'happen':176C 'helper':194C 'host':28B 'i/o':11A,49B,59B 'infrastructur':22B 'init':200C,209C 'insert':135C 'instead':181C 'introduc':192C 'kernel':2A,25B,32B,83C 'known':101C 'kyber':10A,58B,150C 'late':199C 'layer':4A,35B 'leak':62B,152C 'linux':1A,24B,31B,82C 'linux-kernel':23B 'mq':92C,197C,206C 'one':108C 'oper':99C,109C,173C,191C 'passthrough':40B,118C 'prepar':141C 'queue':12A,69B,162C 'read':46B 'read/write':132C 'request':5A,37B,104C,142C,148C,186C 'resolv':89C 'reus':44B 'rq':198C,207C 'rqf':94C,121C,166C 'run':213C 'say':74B 'sched':96C,123C,168C 'schedul':53B,60B,139C 'self':27B 'self-host':26B 'set':55B,93C,165C,182C 'sinc':210C 'sourc':71B 'stall':8A,67B,160C 'subsequ':131C 'time':208C 'togeth':214C 'token':65B,155C 'trigger':79B 'two':212C 'use':95C,122C,126C,167C 'vulner':86C 'without':140C,146C 'write':48B 'wrong':52B","nicknames":[],"mitigations":[],"who_affected":"Systems running a Linux kernel with the kyber I/O scheduler in use on block devices with blk-mq request caching. The sources do not say which kernel versions are affected or how common kyber is, so teams should check their kernel build and scheduler setting. Systems without kyber selected are likely less exposed, but the sources do not confirm this.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-18T16:17:36+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-98820","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-98820","severity":null,"published_at":"2026-10-18T16:17:36+00:00","modified_at":"2026-10-19T10:19:46+00:00","first_seen_at":"2026-10-23T21:57:17+00:00","fetched_at":"2026-10-23T22:28:56+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}