{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-64017", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-07-19T07:54:57.027Z", "datePublished": "2026-07-19T15:39:11.989Z", "dateUpdated": "2026-08-19T16:28:11.145Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-19T16:28:11.145Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nblk-mq: pop cached request if it is usable\n\nWhen submitting a bio to blk-mq, if the task should sleep after peeking\na cached request, but before it pops it, the plug flushes and calls\nblk_mq_free_plug_rqs, freeing the cached_rqs. This creates a\nuse-after-free bug. Fix this by popping the cached request before any\npossible blocking calls if it is suitable for use.\n\nPopping this request first holds a queue reference, so avoid any\nserialization races with queue freezes and can safely proceed with\ndispatching that request to the driver. This potentially increases a\ntiming window from when a driver wants to freeze its queue to when\nrequests stop being dispatched. That scenario is off the fast path\nthough, and drivers need to appropriately handle requests during a\nfreeze request anyway.\n\nThe downside is the popped element needs to be individually freed when\nwe performed a bio plug merge. The cached request would have had to be\nfreed later anyway, but this patch does it inline with building the plug\nlist instead of after flushing it."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:L - The bug is in `blk_mq_submit_bio()`, reached from local block I/O submission (`submit_bio` via read/write, filesystem I/O, or io_uring). Reliable exploitation requires a `blk_plug` with populated `cached_rqs`, which occurs when io_uring submits batches of 3+ plugged read/write operations (`blk_start_plug_nr_ios`); remote-only paths like nfsd/ksmbd/nvmet typically use `blk_start_plug()` with `nr_ios=1` and do not populate the cached-request list needed to hit the peek-without-pop window.\nAC:L - An attacker controls both sides of the race by batching io_uring I/O and inducing a sleep between peek and pop (e.g., memory pressure during bio split/allocation, or `bio_integrity_prep()` blocking on PI-capable enterprise/cloud NVMe). Plug flush on any schedule is deterministic kernel behavior, not an uncontrollable environmental condition.\nPR:L - Triggering requires only an unprivileged local process able to perform block-backed I/O (normal file read/write or io_uring readv/writev to accessible storage); no root, `CAP_SYS_ADMIN`, or special kernel capabilities are needed beyond standard filesystem/device access available to any local user.\nUI:N - Exploitation is driven entirely by the attacker's own I/O submissions through io_uring or direct block I/O; no action by another user or administrator is required.\nS:U - Impact is confined to kernel memory via a block-layer use-after-free on `struct request`; this is standard kernel privilege escalation territory and does not cross a VM, IOMMU, or sandbox security boundary.\nC:H - This is a use-after-free of a `struct request` object; the attacker can influence post-free heap contents and dereference freed fields (`rq->q`, `rq->mq_hctx`, `rq->bio`), enabling arbitrary kernel memory read primitives.\nI:H - UAF on `struct request` permits controlled writes through subsequent use of the dangling object (`rq->cmd_flags`, `queuelist`, bio attachment in `blk_mq_bio_to_request`), enabling heap corruption and potential arbitrary code execution in kernel context.\nA:H - The freed request is dereferenced during `blk_mq_use_cached_rq()` and subsequent request setup, causing kernel oops/panic; even without full exploitation, UAF reliably threatens system availability."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["block/blk-mq.c"], "versions": [{"version": "b0077e269f6c152e807fdac90b58caf012cdbaab", "lessThan": "23d8ea1e303b5f32d883757a4a707e791dbc9808", "status": "affected", "versionType": "git"}, {"version": "b0077e269f6c152e807fdac90b58caf012cdbaab", "lessThan": "97e2d08de282ef76f84ab4ccd00f1acb3f5f999e", "status": "affected", "versionType": "git"}, {"version": "b0077e269f6c152e807fdac90b58caf012cdbaab", "lessThan": "388468f7e7d1eab092cf2a39fdfb502e52019ec6", "status": "affected", "versionType": "git"}, {"version": "b0077e269f6c152e807fdac90b58caf012cdbaab", "lessThan": "dc278e9bf2b9513a763353e6b9cc21e0f532954e", "status": "affected", "versionType": "git"}, {"version": "b5c8e0ff76d10f6bf70a7237678f27c20cf59bc9", "status": "affected", "versionType": "git"}, {"version": "e9c309ded295b7f8849097d71ae231456ca79f78", "status": "affected", "versionType": "git"}, {"version": "b80056bd75a16e4550873ecefe12bc8fd190b1cf", "status": "affected", "versionType": "git"}, {"version": "33cf52b6e53a6aa55883aa7fb9ceffceff8488a6", "status": "affected", "versionType": "git"}, {"version": "8b6075046470c8756242dfe3fd058813636f69a3", "status": "affected", "versionType": "git"}, {"version": "6.1.72", "lessThan": "6.2", "status": "affected", "versionType": "semver"}, {"version": "6.5.13", "lessThan": "6.6", "status": "affected", "versionType": "semver"}, {"version": "6.6.3", "lessThan": "6.7", "status": "affected", "versionType": "semver"}, {"version": "6.1.75", "lessThan": "6.2", "status": "affected", "versionType": "semver"}, {"version": "6.6.14", "lessThan": "6.7", "status": "affected", "versionType": "semver"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["block/blk-mq.c"], "versions": [{"version": "6.7", "status": "affected"}, {"version": "0", "lessThan": "6.7", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.104", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.45", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.0.11", "lessThanOrEqual": "7.0.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.1", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.7", "versionEndExcluding": "6.12.104"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.7", "versionEndExcluding": "6.18.45"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.7", "versionEndExcluding": "7.0.11"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.7", "versionEndExcluding": "7.1"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.1.72"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.5.13"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.6.3"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.1.75"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.6.14"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/23d8ea1e303b5f32d883757a4a707e791dbc9808"}, {"url": "https://git.kernel.org/stable/c/97e2d08de282ef76f84ab4ccd00f1acb3f5f999e"}, {"url": "https://git.kernel.org/stable/c/388468f7e7d1eab092cf2a39fdfb502e52019ec6"}, {"url": "https://git.kernel.org/stable/c/dc278e9bf2b9513a763353e6b9cc21e0f532954e"}], "title": "blk-mq: pop cached request if it is usable", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["block/blk-mq.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "23d8ea1e303b5f32d883757a4a707e791dbc9808", "status": "affected", "version": "b0077e269f6c152e807fdac90b58caf012cdbaab", "versionType": "git"}, {"lessThan": "97e2d08de282ef76f84ab4ccd00f1acb3f5f999e", "status": "affected", "version": "b0077e269f6c152e807fdac90b58caf012cdbaab", "versionType": "git"}, {"lessThan": "388468f7e7d1eab092cf2a39fdfb502e52019ec6", "status": "affected", "version": "b0077e269f6c152e807fdac90b58caf012cdbaab", "versionType": "git"}, {"lessThan": "dc278e9bf2b9513a763353e6b9cc21e0f532954e", "status": "affected", "version": "b0077e269f6c152e807fdac90b58caf012cdbaab", "versionType": "git"}, {"status": "affected", "version": "b5c8e0ff76d10f6bf70a7237678f27c20cf59bc9", "versionType": "git"}, {"status": "affected", "version": "e9c309ded295b7f8849097d71ae231456ca79f78", "versionType": "git"}, {"status": "affected", "version": "b80056bd75a16e4550873ecefe12bc8fd190b1cf", "versionType": "git"}, {"status": "affected", "version": "33cf52b6e53a6aa55883aa7fb9ceffceff8488a6", "versionType": "git"}, {"status": "affected", "version": "8b6075046470c8756242dfe3fd058813636f69a3", "versionType": "git"}, {"lessThan": "6.2", "status": "affected", "version": "6.1.72", "versionType": "semver"}, {"lessThan": "6.6", "status": "affected", "version": "6.5.13", "versionType": "semver"}, {"lessThan": "6.7", "status": "affected", "version": "6.6.3", "versionType": "semver"}, {"lessThan": "6.2", "status": "affected", "version": "6.1.75", "versionType": "semver"}, {"lessThan": "6.7", "status": "affected", "version": "6.6.14", "versionType": "semver"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["block/blk-mq.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "6.7"}, {"lessThan": "6.7", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.104", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.45", "versionType": "semver"}, {"lessThanOrEqual": "7.0.*", "status": "unaffected", "version": "7.0.11", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.1", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nblk-mq: pop cached request if it is usable\n\nWhen submitting a bio to blk-mq, if the task should sleep after peeking\na cached request, but before it pops it, the plug flushes and calls\nblk_mq_free_plug_rqs, freeing the cached_rqs. This creates a\nuse-after-free bug. Fix this by popping the cached request before any\npossible blocking calls if it is suitable for use.\n\nPopping this request first holds a queue reference, so avoid any\nserialization races with queue freezes and can safely proceed with\ndispatching that request to the driver. This potentially increases a\ntiming window from when a driver wants to freeze its queue to when\nrequests stop being dispatched. That scenario is off the fast path\nthough, and drivers need to appropriately handle requests during a\nfreeze request anyway.\n\nThe downside is the popped element needs to be individually freed when\nwe performed a bio plug merge. The cached request would have had to be\nfreed later anyway, but this patch does it inline with building the plug\nlist instead of after flushing it."}], "id": "CVE-2026-64017", "lastModified": "2026-08-19T17:20:14.617", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}]}, "published": "2026-07-19T16:17:41.680", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/23d8ea1e303b5f32d883757a4a707e791dbc9808"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/388468f7e7d1eab092cf2a39fdfb502e52019ec6"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/97e2d08de282ef76f84ab4ccd00f1acb3f5f999e"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/dc278e9bf2b9513a763353e6b9cc21e0f532954e"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Awaiting Analysis"}

{"bugzilla": {"description": "kernel: blk-mq: pop cached request if it is usable", "id": "2502449", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2502449"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.0", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "status": "draft"}, "cwe": "CWE-825", "details": ["In the Linux kernel, the following vulnerability has been resolved:\nblk-mq: pop cached request if it is usable\nWhen submitting a bio to blk-mq, if the task should sleep after peeking\na cached request, but before it pops it, the plug flushes and calls\nblk_mq_free_plug_rqs, freeing the cached_rqs. This creates a\nuse-after-free bug. Fix this by popping the cached request before any\npossible blocking calls if it is suitable for use.\nPopping this request first holds a queue reference, so avoid any\nserialization races with queue freezes and can safely proceed with\ndispatching that request to the driver. This potentially increases a\ntiming window from when a driver wants to freeze its queue to when\nrequests stop being dispatched. That scenario is off the fast path\nthough, and drivers need to appropriately handle requests during a\nfreeze request anyway.\nThe downside is the popped element needs to be individually freed when\nwe performed a bio plug merge. The cached request would have had to be\nfreed later anyway, but this patch does it inline with building the plug\nlist instead of after flushing it.", "A flaw was found in the Linux kernel's blk-mq component. This use-after-free vulnerability occurs when a task attempts to submit a bio (a data structure for I/O operations) to blk-mq. If the task is interrupted and sleeps after checking for a cached request but before using it, the cached request can be prematurely freed. This can lead to system instability or crashes."], "name": "CVE-2026-64017", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2026-07-19T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-64017\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-64017\nhttps://lore.kernel.org/linux-cve-announce/2026071900-CVE-2026-64017-c8ee@gregkh/T"], "threat_severity": "Important"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[b0077e269f6c152e807fdac90b58caf012cdbaab,388468f7e7d1eab092cf2a39fdfb502e52019ec6)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[b0077e269f6c152e807fdac90b58caf012cdbaab,dc278e9bf2b9513a763353e6b9cc21e0f532954e)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "b5c8e0ff76d10f6bf70a7237678f27c20cf59bc9"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "e9c309ded295b7f8849097d71ae231456ca79f78"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "b80056bd75a16e4550873ecefe12bc8fd190b1cf"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "33cf52b6e53a6aa55883aa7fb9ceffceff8488a6"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "8b6075046470c8756242dfe3fd058813636f69a3"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[6.1.72,6.2)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[6.5.13,6.6)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[6.6.3,6.7)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[6.1.75,6.2)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[6.6.14,6.7)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "6.7"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[0,6.7)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.0.11,7.1.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.1,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-07-21T22:45:02.379097+00:00", "updated": "2026-08-04T06:15:04.069409+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}