blk-iolatency: clear delay state when freeing policy data
In the Linux kernel, the following vulnerability has been resolved: blk-iolatency: clear delay state when freeing policy data io.latency can throttle a group which has no latency target of its own. When a sibling misses its target, check_scale_change() scales down its peers, and a peer that reaches queue depth one gets blkcg_use_delay() called on it on every further scale-down, even with min_lat_nsec == 0. iolatency_pd_offline() resets the target through iolatency_set_min_lat_nsec(), which clears the delay only on a nonzero to zero transition, so it never clears such a peer. Freeing the policy data then leaves blkg->use_delay set and blkcg->congestion_count elevated with nothing left that can drop it. blk_cgroup_congested() then returns true for every task in that cgroup and its descendants for as long as the cgroup lives: page_cache_sync_ra() cuts readahead to a single page, page_cache_async_ra() skips it altogether, and __folio_throttle_swaprate() takes swap_avail_lock and schedules a throttle on anonymous folio allocation. Clear the delay in iolatency_pd_free(). By then bio-held blkg references have drained, or the queue is frozen for policy deactivation, so check_scale_change() cannot re-arm it. The free callback can also see policy data which was never attached to a blkg, hence the pd->blkg check.
CVE-2026-90183
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: cve:CVE-2026-90183
Linux
Source reference: /containers/cna/affected/0/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Linux
Source reference: /containers/cna/affected/1/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "d70675121546c35feaceebf7ed9caed8716640f3",
"lessThan": "53ccb4b967edc5f82ff6f9c066fb96c31aa7561a",
"versionType": "git"
},
{
"status": "affected",
"version": "d70675121546c35feaceebf7ed9caed8716640f3",
"lessThan": "b6449a915d1826e1450f6368fc379fe44caa06ca",
"versionType": "git"
},
{
"status": "affected",
"version": "d70675121546c35feaceebf7ed9caed8716640f3",
"lessThan": "5c6593422eb3c3a21505436ccf74599a433584c8",
"versionType": "git"
},
{
"status": "affected",
"version": "d70675121546c35feaceebf7ed9caed8716640f3",
"lessThan": "02f1b90ab33ef99c89dd96a385b432ff57abc64d",
"versionType": "git"
},
{
"status": "affected",
"version": "d70675121546c35feaceebf7ed9caed8716640f3",
"lessThan": "8935bf22c0a0db517a7f72f7097300e05dd852f5",
"versionType": "git"
}
],
"programFiles": [
"block/blk-iolatency.c"
],
"defaultStatus": "unaffected"
},
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "4.19"
},
{
"status": "unaffected",
"version": "0",
"lessThan": "4.19",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "6.6.160",
"versionType": "semver",
"lessThanOrEqual": "6.6.*"
},
{
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver",
"lessThanOrEqual": "6.12.*"
},
{
"status": "unaffected",
"version": "6.18.57",
"versionType": "semver",
"lessThanOrEqual": "6.18.*"
},
{
"status": "unaffected",
"version": "7.2.6",
"versionType": "semver",
"lessThanOrEqual": "7.2.*"
},
{
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix",
"lessThanOrEqual": "*"
}
],
"programFiles": [
"block/blk-iolatency.c"
],
"defaultStatus": "affected"
}
]- Related CVEs
- CVE-2026-90183
Source reference:
/cveMetadata/cveId
Publisher severity
No explicit severity was provided.
- Event
- #48630 · Revision 1
- Added to Heist Feed
- Publisher date