All vulnerabilities
CVE-2026-98820

Linux: blk-mq: set RQF_USE_SCHED when the operation is known

Linux LinuxOperating systems
Open in ThreatlineRecord JSON
CVSS
NoneNot scored
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.21%Chance of exploitation activity in the next 30 days, higher than 10% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in790730e4d95de8356a573d4b4864486bba731863Also 2c47ebc27fa72078e26177cd458cdaf3006a9685CVE List
Published18 Oct 2026Updated 19 Oct 2026CVE List

What fixes it

  • 790730e4d95de8356a573d4b4864486bba731863LinuxCVE List
  • 2c47ebc27fa72078e26177cd458cdaf3006a9685LinuxCVE List

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

In the Linux kernel, the following vulnerability has been resolved:

blk-mq: set RQF_USE_SCHED when the operation is known

The cached requests are allocated for one operation but can be handed out for another. A passthrough command has RQF_USE_SCHED cleared, so using those flags for a subsequent read/write bio will insert it into the scheduler without ->prepare_request() and frees it without ->finish_request(). For kyber, this leaks the domain token acquired at dispatch and stalls the queue.

Don't set RQF_USE_SCHED based on the first operation the batch happened to be allocated for. Instead, set it after the request is claimed by an operation. Introduce a helper function, blk_mq_rq_late_init() for this, and absorb blk_mq_rq_time_init() since the two run together.

Text from CVE List

Affected versions 8

  • Linuxaffected: 4b6a5d9cea911424e84107df8c4eb8317938d2cd before 790730e4d95de8356a573d4b4864486bba731863CVE List
  • Linuxaffected: 4b6a5d9cea911424e84107df8c4eb8317938d2cd before 2c47ebc27fa72078e26177cd458cdaf3006a9685CVE List
  • Linuxaffected: 4b6a5d9cea911424e84107df8c4eb8317938d2cd before ab6c756f28c741d704a7c3e04814bfc3adf6f818CVE List
  • Linuxaffected: 6.1CVE List
  • Linuxunaffected: all versions before 6.1CVE List
  • Linuxunaffected: 6.18.56 through 6.18.*CVE List
  • Linuxunaffected: 7.2.10 through 7.2.*CVE List
  • Linuxunaffected: 7.3CVE List

References 3