CVE-2026-64017 blk-mq: pop cached request if it is usable
A use-after-free in the Linux kernel block layer allows attackers to potentially execute code or escalate privileges via crafted I/O operations.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-64017?
CVE-2026-64017 is a high-severity use after free vulnerability in Linux kernel, published on 19 Jul 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
blk-mq: pop cached request if it is usable
When submitting a bio to blk-mq, if the task should sleep after peeking a cached request, but before it pops it, the plug flushes and calls blk_mq_free_plug_rqs, freeing the cached_rqs. This creates a use-after-free bug. Fix this by popping the cached request before any possible blocking calls if it is suitable for use.
Popping this request first holds a queue reference, so avoid any serialization races with queue freezes and can safely proceed with dispatching that request to the driver. This potentially increases a timing window from when a driver wants to freeze its queue to when requests stop being dispatched. That scenario is off the fast path though, and drivers need to appropriately handle requests during a freeze request anyway.
The downside is the popped element needs to be individually freed when we performed a bio plug merge. The cached request would have had to be freed later anyway, but this patch does it inline with building the plug list instead of after flushing it.
Weakness: CWE-416
Which versions are affected by CVE-2026-64017?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2026-64017?
Apply the vendor's patch.
Upgrade to the fixed version. These bugs are found with fuzzing and sanitisers and avoided by memory-safe languages. More about Use after free.
Is CVE-2026-64017 being exploited?
There is no known exploitation of CVE-2026-64017 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as AZL-92814, BELL-CVE-2026-64017, DEBIAN-CVE-2026-64017, GHSA-pqjq-mhgh-j532, ROOT-OS-DEBIAN-12-CVE-2026-64017, ROOT-OS-DEBIAN-13-CVE-2026-64017 and 1 more.