CVE-2026-93795 (GCVE-0-2026-93795)
Vulnerability from cvelistv5
Published
2026-09-24 16:02
Modified
2026-10-03 10:57
Severity ?
Summary
In the Linux kernel, the following vulnerability has been resolved: blk-cgroup: fix leaks and online flag on radix_tree_insert failure When radix_tree_insert() fails in blkg_create(), the error path has two issues: 1. blkg->online is set to true unconditionally, even when the blkg was never fully inserted. Move the assignment inside the success block. 2. The error path calls blkg_put() without first calling percpu_ref_kill(). Because the refcount is still in percpu mode, percpu_ref_put() only does this_cpu_sub() without checking for zero, so blkg_release() is never triggered. This permanently leaks the blkg memory, its percpu iostat, policy data, the parent blkg reference, and the cgroup css reference — the latter preventing the cgroup from ever being destroyed. Fix by replacing blkg_put() with percpu_ref_kill(), matching the pattern used in blkg_destroy().
References
Impacted products
Vendor Product Version
Linux Linux Version: 7fcf2b033b84e261dca283bc2911aaea4b07b525
Version: 7fcf2b033b84e261dca283bc2911aaea4b07b525
Version: 7fcf2b033b84e261dca283bc2911aaea4b07b525
Version: 7fcf2b033b84e261dca283bc2911aaea4b07b525
Version: 7fcf2b033b84e261dca283bc2911aaea4b07b525
Version: 7fcf2b033b84e261dca283bc2911aaea4b07b525
Version: 7fcf2b033b84e261dca283bc2911aaea4b07b525
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "block/blk-cgroup.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "0f840db042caee9d2f3dcdcf97d6674f6e4c1e30",
              "status": "affected",
              "version": "7fcf2b033b84e261dca283bc2911aaea4b07b525",
              "versionType": "git"
            },
            {
              "lessThan": "f53945d7c712efe63fadbcc5ffed6370871fd0d3",
              "status": "affected",
              "version": "7fcf2b033b84e261dca283bc2911aaea4b07b525",
              "versionType": "git"
            },
            {
              "lessThan": "ada8270ccdb6f212da5eb22614c28ea418746a4a",
              "status": "affected",
              "version": "7fcf2b033b84e261dca283bc2911aaea4b07b525",
              "versionType": "git"
            },
            {
              "lessThan": "c3650be82ef6e7af13b79b2d10a7363bdf54aa7f",
              "status": "affected",
              "version": "7fcf2b033b84e261dca283bc2911aaea4b07b525",
              "versionType": "git"
            },
            {
              "lessThan": "6e85f02d45b5977c0326a8d854c6db878aa6b34a",
              "status": "affected",
              "version": "7fcf2b033b84e261dca283bc2911aaea4b07b525",
              "versionType": "git"
            },
            {
              "lessThan": "4c0d150fb98ea40760611979f4e664c244b20966",
              "status": "affected",
              "version": "7fcf2b033b84e261dca283bc2911aaea4b07b525",
              "versionType": "git"
            },
            {
              "lessThan": "dbbca20764382b4d411ec2918f4e278ffe547acc",
              "status": "affected",
              "version": "7fcf2b033b84e261dca283bc2911aaea4b07b525",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "block/blk-cgroup.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.0"
            },
            {
              "lessThan": "5.0",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.271",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.222",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.189",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.158",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.111",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.53",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.271",
                  "versionStartIncluding": "5.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.222",
                  "versionStartIncluding": "5.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.189",
                  "versionStartIncluding": "5.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.158",
                  "versionStartIncluding": "5.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.111",
                  "versionStartIncluding": "5.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.53",
                  "versionStartIncluding": "5.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "5.0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nblk-cgroup: fix leaks and online flag on radix_tree_insert failure\n\nWhen radix_tree_insert() fails in blkg_create(), the error path has two\nissues:\n\n1. blkg-\u003eonline is set to true unconditionally, even when the blkg was\n   never fully inserted.  Move the assignment inside the success block.\n\n2. The error path calls blkg_put() without first calling\n   percpu_ref_kill().  Because the refcount is still in percpu mode,\n   percpu_ref_put() only does this_cpu_sub() without checking for zero,\n   so blkg_release() is never triggered.  This permanently leaks the\n   blkg memory, its percpu iostat, policy data, the parent blkg\n   reference, and the cgroup css reference \u2014 the latter preventing the\n   cgroup from ever being destroyed.\n\nFix by replacing blkg_put() with percpu_ref_kill(), matching the pattern\nused in blkg_destroy()."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-03T10:57:30.314Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/0f840db042caee9d2f3dcdcf97d6674f6e4c1e30"
        },
        {
          "url": "https://git.kernel.org/stable/c/f53945d7c712efe63fadbcc5ffed6370871fd0d3"
        },
        {
          "url": "https://git.kernel.org/stable/c/ada8270ccdb6f212da5eb22614c28ea418746a4a"
        },
        {
          "url": "https://git.kernel.org/stable/c/c3650be82ef6e7af13b79b2d10a7363bdf54aa7f"
        },
        {
          "url": "https://git.kernel.org/stable/c/6e85f02d45b5977c0326a8d854c6db878aa6b34a"
        },
        {
          "url": "https://git.kernel.org/stable/c/4c0d150fb98ea40760611979f4e664c244b20966"
        },
        {
          "url": "https://git.kernel.org/stable/c/dbbca20764382b4d411ec2918f4e278ffe547acc"
        }
      ],
      "title": "blk-cgroup: fix leaks and online flag on radix_tree_insert failure",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-93795",
    "datePublished": "2026-09-24T16:02:28.654Z",
    "dateReserved": "2026-09-18T17:59:28.789Z",
    "dateUpdated": "2026-10-03T10:57:30.314Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.