CVE-2026-98820 blk-mq: set RQF_USE_SCHED when the operation is known
A Linux kernel bug in blk-mq allows local attackers to cause a denial of service by stalling the I/O queue through scheduler token leaks.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-98820?
CVE-2026-98820 is a denial of service vulnerability in Linux, published on 18 Oct 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
blk-mq: set RQF_USE_SCHED when the operation is known
The cached requests are allocated for one operation but can be handed out for another. A passthrough command has RQF_USE_SCHED cleared, so using those flags for a subsequent read/write bio will insert it into the scheduler without ->prepare_request() and frees it without ->finish_request(). For kyber, this leaks the domain token acquired at dispatch and stalls the queue.
Don't set RQF_USE_SCHED based on the first operation the batch happened to be allocated for. Instead, set it after the request is claimed by an operation. Introduce a helper function, blk_mq_rq_late_init() for this, and absorb blk_mq_rq_time_init() since the two run together.
Which versions are affected by CVE-2026-98820?
How do I fix CVE-2026-98820?
Apply the vendor's patch.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2026-98820 being exploited?
There is no known exploitation of CVE-2026-98820 in the wild and no public exploit code.
Sources
Also known as AZL-109250, BELL-CVE-2026-98820, DEBIAN-CVE-2026-98820, GHSA-95f6-3pp2-9382, UBUNTU-CVE-2026-98820.