CVE-2026-53126 Overview
CVE-2026-53126 is a resource leak vulnerability in the Linux kernel's block I/O controller cgroup (blk-cgroup) subsystem. The defect resides in the blkcg_maybe_throttle_current() function, which fails to release a disk reference on error paths. When blkcg lookup, blkg lookup, or blkg_tryget() fails, the function jumps to the out label that only calls rcu_read_unlock() without releasing the disk reference previously acquired by blkcg_schedule_throttle() via get_device(). The reference cannot be reclaimed later because current->throttle_disk is set to NULL before the lookup, preventing blkcg_exit() from cleaning it up. The result is a persistent kernel memory and disk reference leak.
Critical Impact
Each failed throttle path leaks a gendisk reference, preventing the disk structure from ever being freed and producing long-term resource exhaustion on systems using block cgroup throttling.
Affected Products
- Linux kernel versions containing the request_queue to gendisk conversion in blkcg_maybe_throttle_current()
- Distributions shipping the affected mainline and stable kernels prior to the fix commits
- Systems that enable block I/O cgroup throttling (CONFIG_BLK_CGROUP)
Discovery Timeline
- 2026-06-24 - CVE-2026-53126 published to the National Vulnerability Database
- 2026-06-24 - Last updated in NVD database
Technical Details for CVE-2026-53126
Vulnerability Analysis
The Linux block cgroup throttling code schedules deferred throttling work for the current task by storing a disk pointer in current->throttle_disk. The reference is taken with get_device() inside blkcg_schedule_throttle() and is expected to be released either when the throttling completes successfully or through an explicit put_disk() on the error path. During the historical conversion of the block layer from request_queue to gendisk, the matching blk_put_queue() call that previously balanced the reference was removed and never replaced with an equivalent put_disk(). The kernel still acquires the reference but no longer releases it when lookup operations fail.
Because blkcg_maybe_throttle_current() nulls out current->throttle_disk before performing any lookups, the only remaining cleanup site, blkcg_exit(), sees no disk reference to release at task exit. Every failed invocation produces one leaked reference, and over time the leaked references prevent disk teardown and consume kernel memory.
Root Cause
The root cause is an incomplete refactoring [CWE-401: Memory Leak]. The original code released the queue reference on the error path using blk_put_queue(). When the subsystem migrated from request_queue to gendisk, the corresponding put_disk() was inadvertently dropped, leaving the error path unbalanced with respect to the get_device() performed in blkcg_schedule_throttle().
Attack Vector
The issue is reachable from any context that triggers block cgroup throttling and encounters a lookup failure for the associated blkcg or blkg. Local processes performing I/O within cgroups configured for throttling can drive repeated failures, gradually leaking gendisk references and pinning kernel objects. The defect is a reliability and resource-exhaustion bug rather than a memory-safety primitive, and no remote attack vector is documented. Exploitation in published proof-of-concept form is not currently available; see the upstream commits in the references for technical detail.
Detection Methods for CVE-2026-53126
Indicators of Compromise
- Growing kernel memory usage attributable to gendisk and associated device objects that are never freed after block device removal
- Block devices that remain referenced after detach or unmount, visible through /sys/block entries failing to clean up
- Sustained increases in kmemleak reports referencing get_device call paths from blkcg_schedule_throttle
Detection Strategies
- Enable CONFIG_DEBUG_KMEMLEAK on test kernels and look for unreleased allocations originating in the block cgroup throttle path
- Audit kernel build versions against the fix commits 000e8454692c, 23308af722fe, 4048ed98860d, 73a5af059905, and b3e005f16cd9 published on git.kernel.org
- Correlate I/O cgroup configuration changes with subsequent rises in slab usage for device and gendisk caches
Monitoring Recommendations
- Track kernel slab statistics for block-layer objects using /proc/slabinfo and alert on monotonic growth
- Monitor dmesg for warnings tied to disk removal or cgroup teardown that reference outstanding holders
- Inventory kernel versions across the fleet and flag hosts running pre-patch builds with block I/O throttling enabled
How to Mitigate CVE-2026-53126
Immediate Actions Required
- Identify hosts running affected Linux kernels with block I/O cgroup throttling enabled and prioritize them for patching
- Apply the upstream stable kernel update that adds the missing put_disk() call in blkcg_maybe_throttle_current()
- Reboot patched systems to ensure the corrected throttling path is active in the running kernel
Patch Information
The fix adds the missing put_disk() on the error path of blkcg_maybe_throttle_current(), restoring the reference release that previously existed as blk_put_queue() before the request_queue to gendisk conversion. Patches are distributed through the Linux stable tree. Refer to the upstream commits: Kernel commit 000e8454, Kernel commit 23308af7, Kernel commit 4048ed98, Kernel commit 73a5af05, and Kernel commit b3e005f1.
Workarounds
- Disable block I/O cgroup throttling on workloads where it is not required to remove the leak's trigger condition
- Schedule periodic reboots on long-running hosts to release leaked gendisk references until the patch is deployed
- Avoid configurations that repeatedly create and destroy cgroups bound to throttled block devices, which accelerate the leak
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
