« Volver al listado

CVE-2026-90183

Estado: RecibidaSin puntuar—

In the Linux kernel, the following vulnerability has been resolved:

blk-iolatency: clear delay state when freeing policy data

io.latency can throttle a group which has no latency target of its own. When a sibling misses its target, check_scale_change() scales down its peers, and a peer that reaches queue depth one gets blkcg_use_delay() called on it on every further scale-down, even with min_lat_nsec == 0.

iolatency_pd_offline() resets the target through iolatency_set_min_lat_nsec(), which clears the delay only on a nonzero to zero transition, so it never clears such a peer. Freeing the policy data then leaves blkg->use_delay set and blkcg->congestion_count elevated with nothing left that can drop it.

Leer descripción completaMostrar menos

blk_cgroup_congested() then returns true for every task in that cgroup and its descendants for as long as the cgroup lives: page_cache_sync_ra() cuts readahead to a single page, page_cache_async_ra() skips it altogether, and __folio_throttle_swaprate() takes swap_avail_lock and schedules a throttle on anonymous folio allocation.

Clear the delay in iolatency_pd_free(). By then bio-held blkg references have drained, or the queue is frozen for policy deactivation, so check_scale_change() cannot re-arm it. The free callback can also see policy data which was never attached to a blkg, hence the pd->blkg check.

CVSS

NVD no ha asignado puntuación CVSS a esta CVE (habitual desde el cambio de política de abril de 2026).

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

Linux — Linux KernelAI

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2026-90183",
  "cveTags": [],
  "metrics": {},
  "affected": [
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "affectedData": [
        {
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "product": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "d70675121546c35feaceebf7ed9caed8716640f3",
              "lessThan": "02f1b90ab33ef99c89dd96a385b432ff57abc64d",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "d70675121546c35feaceebf7ed9caed8716640f3",
              "lessThan": "8935bf22c0a0db517a7f72f7097300e05dd852f5",
              "versionType": "git"
            }
          ],
          "programFiles": [
            "block/blk-iolatency.c"
          ],
          "defaultStatus": "unaffected"
        },
        {
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "product": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.19"
            },
            {
              "status": "unaffected",
              "version": "0",
              "lessThan": "4.19",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "7.2.6",
              "versionType": "semver",
              "lessThanOrEqual": "7.2.*"
            },
            {
              "status": "unaffected",
              "version": "7.3-rc1",
              "versionType": "original_commit_for_fix",
              "lessThanOrEqual": "*"
            }
          ],
          "programFiles": [
            "block/blk-iolatency.c"
          ],
          "defaultStatus": "affected"
        }
      ]
    }
  ],
  "published": "2026-09-17T17:17:12.710",
  "references": [
    {
      "url": "https://git.kernel.org/stable/c/02f1b90ab33ef99c89dd96a385b432ff57abc64d",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/8935bf22c0a0db517a7f72f7097300e05dd852f5",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    }
  ],
  "vulnStatus": "Received",
  "descriptions": [
    {
      "lang": "en",
      "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nblk-iolatency: clear delay state when freeing policy data\n\nio.latency can throttle a group which has no latency target of its own.\nWhen a sibling misses its target, check_scale_change() scales down its\npeers, and a peer that reaches queue depth one gets blkcg_use_delay()\ncalled on it on every further scale-down, even with min_lat_nsec == 0.\n\niolatency_pd_offline() resets the target through\niolatency_set_min_lat_nsec(), which clears the delay only on a nonzero\nto zero transition, so it never clears such a peer.  Freeing the policy\ndata then leaves blkg->use_delay set and blkcg->congestion_count\nelevated with nothing left that can drop it.\n\nblk_cgroup_congested() then returns true for every task in that cgroup\nand its descendants for as long as the cgroup lives: page_cache_sync_ra()\ncuts readahead to a single page, page_cache_async_ra() skips it\naltogether, and __folio_throttle_swaprate() takes swap_avail_lock and\nschedules a throttle on anonymous folio allocation.\n\nClear the delay in iolatency_pd_free().  By then bio-held blkg\nreferences have drained, or the queue is frozen for policy\ndeactivation, so check_scale_change() cannot re-arm it.  The free\ncallback can also see policy data which was never attached to a blkg,\nhence the pd->blkg check."
    }
  ],
  "lastModified": "2026-09-17T17:17:12.710",
  "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}