Skip to content
Heist/ feed
Back to feed
UnratedFix available

blk-iolatency: clear delay state when freeing policy data

Type: advisorySources: OSV

In the Linux kernel, the following vulnerability has been resolved: blk-iolatency: clear delay state when freeing policy data io.latency can throttle a group which has no latency target of its own. When a sibling misses its target, check_scale_change() scales down its peers, and a peer that reaches queue depth one gets blkcg_use_delay() called on it on every further scale-down, even with min_lat_nsec == 0. iolatency_pd_offline() resets the target through iolatency_set_min_lat_nsec(), which clears the delay only on a nonzero to zero transition, so it never clears such a peer. Freeing the policy data then leaves blkg->use_delay set and blkcg->congestion_count elevated with nothing left that can drop it. blk_cgroup_congested() then returns true for every task in that cgroup and its descendants for as long as the cgroup lives: page_cache_sync_ra() cuts readahead to a single page, page_cache_async_ra() skips it altogether, and __folio_throttle_swaprate() takes swap_avail_lock and schedules a throttle on anonymous folio allocation. Clear the delay in iolatency_pd_free(). By then bio-held blkg references have drained, or the queue is frozen for policy deactivation, so check_scale_change() cannot re-arm it. The free callback can also see policy data which was never attached to a blkg, hence the pd->blkg check.

Products
Kernel
Affected versions
Not specified
Fixed versions
6.1.191, 6.12.114, 6.18.57, 6.6.160, 7.2.6
CVEs
CVE-2026-90183
Confirmed fixed CVEs
Not specified
Updated in this feed
3 Nov 2026, 05:06 UTC · Revision 1

Source evidence

blk-iolatency: clear delay state when freeing policy data

core-osv · Original source

Published 17 Sept 2026, 16:07 UTC

In the Linux kernel, the following vulnerability has been resolved: blk-iolatency: clear delay state when freeing policy data io.latency can throttle a group which has no latency target of its own. When a sibling misses its target, check_scale_change() scales down its peers, and a peer that reaches queue depth one gets blkcg_use_delay() called on it on every further scale-down, even with min_lat_nsec == 0. iolatency_pd_offline() resets the target through iolatency_set_min_lat_nsec(), which clears the delay only on a nonzero to zero transition, so it never clears such a peer. Freeing the policy data then leaves blkg->use_delay set and blkcg->congestion_count elevated with nothing left that can drop it. blk_cgroup_congested() then returns true for every task in that cgroup and its descendants for as long as the cgroup lives: page_cache_sync_ra() cuts readahead to a single page, page_cache_async_ra() skips it altogether, and __folio_throttle_swaprate() takes swap_avail_lock and schedules a throttle on anonymous folio allocation. Clear the delay in iolatency_pd_free(). By then bio-held blkg references have drained, or the queue is frozen for policy deactivation, so check_scale_change() cannot re-arm it. The free callback can also see policy data which was never attached to a blkg, hence the pd->blkg check.

osv:CVE-2026-90183

Kernel

Fixed versions: 6.1.191, 6.6.160, 6.12.114, 6.18.57, 7.2.6

Complete source record
{
  "id": "ee00f0c5a6419080a46a8f6410f93132eb6445f26f99e34c6fe8e28cc286d105",
  "url": "https://osv.dev/vulnerability/CVE-2026-90183",
  "method": "structured",
  "payload": {
    "kind": "advisory",
    "title": "blk-iolatency: clear delay state when freeing policy data",
    "summary": "In the Linux kernel, the following vulnerability has been resolved: blk-iolatency: clear delay state when freeing policy data io.latency can throttle a group which has no latency target of its own. When a sibling misses its target, check_scale_change() scales down its peers, and a peer that reaches queue depth one gets blkcg_use_delay() called on it on every further scale-down, even with min_lat_nsec == 0. iolatency_pd_offline() resets the target through iolatency_set_min_lat_nsec(), which clears the delay only on a nonzero to zero transition, so it never clears such a peer. Freeing the policy data then leaves blkg->use_delay set and blkcg->congestion_count elevated with nothing left that can drop it. blk_cgroup_congested() then returns true for every task in that cgroup and its descendants for as long as the cgroup lives: page_cache_sync_ra() cuts readahead to a single page, page_cache_async_ra() skips it altogether, and __folio_throttle_swaprate() takes swap_avail_lock and schedules a throttle on anonymous folio allocation. Clear the delay in iolatency_pd_free(). By then bio-held blkg references have drained, or the queue is frozen for policy deactivation, so check_scale_change() cannot re-arm it. The free callback can also see policy data which was never attached to a blkg, hence the pd->blkg check.",
    "evidence": "osv:CVE-2026-90183",
    "products": [
      {
        "name": {
          "value": "Kernel",
          "evidence": "/affected/1/package/name"
        },
        "prerequisites": [],
        "fixed_versions": [
          {
            "value": "6.1.191",
            "evidence": "/affected/1/ranges"
          },
          {
            "value": "6.6.160",
            "evidence": "/affected/1/ranges"
          },
          {
            "value": "6.12.114",
            "evidence": "/affected/1/ranges"
          },
          {
            "value": "6.18.57",
            "evidence": "/affected/1/ranges"
          },
          {
            "value": "7.2.6",
            "evidence": "/affected/1/ranges"
          }
        ],
        "affected_versions": []
      }
    ],
    "severity": "unknown",
    "structured": {
      "id": "CVE-2026-90183",
      "aliases": [
        "CVE-2026-90183"
      ],
      "affected": [
        {
          "ranges": [
            {
              "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
              "type": "GIT",
              "events": [
                {
                  "introduced": "d70675121546c35feaceebf7ed9caed8716640f3"
                },
                {
                  "fixed": "27573278b1cbc2313ebd31309ac18ac6179b828a"
                },
                {
                  "fixed": "53ccb4b967edc5f82ff6f9c066fb96c31aa7561a"
                },
                {
                  "fixed": "b6449a915d1826e1450f6368fc379fe44caa06ca"
                },
                {
                  "fixed": "5c6593422eb3c3a21505436ccf74599a433584c8"
                },
                {
                  "fixed": "02f1b90ab33ef99c89dd96a385b432ff57abc64d"
                },
                {
                  "fixed": "8935bf22c0a0db517a7f72f7097300e05dd852f5"
                }
              ]
            }
          ],
          "database_specific": {
            "source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-90183.json"
          }
        },
        {
          "ranges": [
            {
              "type": "ECOSYSTEM",
              "events": [
                {
                  "introduced": "4.19.0"
                },
                {
                  "fixed": "6.1.191"
                }
              ]
            },
            {
              "type": "ECOSYSTEM",
              "events": [
                {
                  "introduced": "6.2.0"
                },
                {
                  "fixed": "6.6.160"
                }
              ]
            },
            {
              "type": "ECOSYSTEM",
              "events": [
                {
                  "introduced": "6.7.0"
                },
                {
                  "fixed": "6.12.114"
                }
              ]
            },
            {
              "type": "ECOSYSTEM",
              "events": [
                {
                  "introduced": "6.13.0"
                },
                {
                  "fixed": "6.18.57"
                }
              ]
            },
            {
              "type": "ECOSYSTEM",
              "events": [
                {
                  "introduced": "6.19.0"
                },
                {
                  "fixed": "7.2.6"
                }
              ]
            }
          ],
          "package": {
            "name": "Kernel",
            "ecosystem": "Linux"
          },
          "database_specific": {
            "source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-90183.json"
          }
        }
      ],
      "modified": "2026-11-01T02:30:29.161403307Z",
      "provider": "osv",
      "references": [
        "https://git.kernel.org/stable/c/02f1b90ab33ef99c89dd96a385b432ff57abc64d",
        "https://git.kernel.org/stable/c/27573278b1cbc2313ebd31309ac18ac6179b828a",
        "https://git.kernel.org/stable/c/53ccb4b967edc5f82ff6f9c066fb96c31aa7561a",
        "https://git.kernel.org/stable/c/5c6593422eb3c3a21505436ccf74599a433584c8",
        "https://git.kernel.org/stable/c/8935bf22c0a0db517a7f72f7097300e05dd852f5",
        "https://git.kernel.org/stable/c/b6449a915d1826e1450f6368fc379fe44caa06ca",
        "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/90xxx/CVE-2026-90183.json",
        "https://nvd.nist.gov/vuln/detail/CVE-2026-90183",
        "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git"
      ],
      "provider_metadata": {
        "cna_assigner": "Linux",
        "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/90xxx/CVE-2026-90183.json"
      }
    },
    "related_cves": [
      {
        "value": "CVE-2026-90183",
        "evidence": "/id"
      }
    ],
    "security_relevant": true,
    "severity_evidence": null
  },
  "source_id": "core-osv",
  "document_id": 492640,
  "published_at": "2026-09-17T16:07:07.045+00:00"
}