CVE-2026-63802 blk-cgroup: fix UAF in __blkcg_rstat_flush()
A use-after-free race condition in the Linux kernel block cgroup subsystem allows local attackers to potentially execute code or escalate privileges.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-63802?
CVE-2026-63802 is a high-severity use after free vulnerability in Linux kernel, published on 19 Jul 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
blk-cgroup: fix UAF in __blkcg_rstat_flush()
When multiple blkgs in the same blkcg are released concurrently, a use-after-free can occur. The race happens when one blkg's __blkcg_rstat_flush() removes another blkg's iostat entries via llist_del_all(). The second blkg sees an empty list and proceeds to free itself while the first is still iterating over its entries.
Move the flush from __blkg_release() (RCU callback) to blkg_release() (before call_rcu). This ensures the RCU grace period waits for any concurrent flush's rcu_read_lock() section to complete before freeing.
Which versions are affected by CVE-2026-63802?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2026-63802?
Apply the vendor's patch.
Upgrade to the fixed version. These bugs are found with fuzzing and sanitisers and avoided by memory-safe languages. More about Use after free.
Is CVE-2026-63802 being exploited?
There is no known exploitation of CVE-2026-63802 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as BELL-CVE-2026-63802, DEBIAN-CVE-2026-63802, GHSA-22rm-57qw-fv2w, UBUNTU-CVE-2026-63802.