CVE-2026-53126

ANALYSIS PENDING

blk-cgroup: fix disk reference leak in blkcg_maybe_throttle_current()

Title source: cna
STIX 2.1

Description

In the Linux kernel, the following vulnerability has been resolved: blk-cgroup: fix disk reference leak in blkcg_maybe_throttle_current() Add the missing put_disk() on the error path in blkcg_maybe_throttle_current(). When blkcg lookup, blkg lookup, or blkg_tryget() fails, the function jumps to the out label which only calls rcu_read_unlock() but does not release the disk reference acquired by blkcg_schedule_throttle() via get_device(). Since current->throttle_disk is already set to NULL before the lookup, blkcg_exit() cannot release this reference either, causing the disk to never be freed. Restore the reference release that was present as blk_put_queue() in the original code but was inadvertently dropped during the conversion from request_queue to gendisk.

Scores

EPSS 0.0016
EPSS Percentile 5.2%

Details

Status published
Products (16)
linux/Kernel 6.13.0 - 6.18.33linux
linux/Kernel 6.19.0 - 7.0.10linux
linux/Kernel 6.3.0 - 6.6.141linux
linux/Kernel 6.7.0 - 6.12.91linux
Linux/Linux < 6.3
Linux/Linux 6.12.91 - 6.12.*
Linux/Linux 6.18.33 - 6.18.*
Linux/Linux 6.3
Linux/Linux 6.6.141 - 6.6.*
Linux/Linux 7.0.10 - 7.0.*
... and 6 more
Published Jun 24, 2026
Tracked Since Jun 24, 2026