CVE-2026-63802: Linux Kernel Use-After-Free Vulnerability

CVE-2026-63802 Overview

CVE-2026-63802 is a use-after-free (UAF) vulnerability in the Linux kernel's block cgroup (blk-cgroup) subsystem. The flaw resides in the __blkcg_rstat_flush() function and triggers when multiple block cgroups (blkgs) within the same blkcg are released concurrently. One blkg's flush routine removes another blkg's iostat entries through llist_del_all(), and the second blkg proceeds to free itself while the first is still iterating the shared list. The upstream fix moves the flush from the RCU callback __blkg_release() to blkg_release() before call_rcu, ensuring the RCU grace period waits for concurrent readers.

Critical Impact
A local attacker with low privileges can trigger concurrent blkg releases to corrupt kernel memory, potentially achieving privilege escalation on affected Linux systems.

Affected Products

Linux kernel branches containing the vulnerable blk-cgroup rstat flush logic
Distributions shipping unpatched stable kernels prior to the referenced fix commits
Systems using block I/O cgroups for resource control

Discovery Timeline

2026-07-19 - CVE-2026-63802 published to NVD
2026-07-20 - Last updated in NVD database

Technical Details for CVE-2026-63802

Vulnerability Analysis

The vulnerability is a race condition producing a use-after-free in the block cgroup rstat (recursive stats) flush path. The Linux kernel tracks per-cgroup I/O statistics using a lock-less list (llist) of pending iostat entries. When a blkg reference count drops to zero, the kernel schedules cleanup that flushes pending stats before freeing the structure.

Under the vulnerable design, the flush executed inside __blkg_release(), an RCU callback invoked after the grace period. Because __blkcg_rstat_flush() calls llist_del_all() on a per-CPU list shared across all blkgs in the same blkcg, one releasing blkg could drain iostat entries belonging to a sibling blkg. The sibling, seeing its own list empty, would then complete its release and free memory that the first flusher was still dereferencing.

Root Cause

The root cause is incorrect ordering between the rstat flush and the RCU grace period. The flush operated on shared per-CPU llists but ran without guaranteeing that concurrent readers on other CPUs had completed their rcu_read_lock() sections. This violates the standard RCU pattern where publish/unpublish must precede the grace period wait.

Attack Vector

Exploitation requires local access with the ability to create, populate, and destroy block cgroups. An attacker with CAP_SYS_ADMIN in a user namespace, or in environments where unprivileged cgroup delegation is permitted, can script rapid creation and teardown of multiple blkgs under a shared blkcg while generating block I/O to populate iostat entries. Concurrent release of these blkgs on different CPUs increases the probability of hitting the race. Successful exploitation corrupts kernel heap memory and can be shaped into privilege escalation. The vulnerability is not remotely reachable and requires no user interaction beyond the attacker's own workload.

No public proof-of-concept is available at this time. Technical detail is documented in the upstream commits 0ab5ee5, 5e5b7f2, 96e5454, afebe44, and bbebd94.

Detection Methods for CVE-2026-63802

Indicators of Compromise

Kernel oops or BUG: KASAN: use-after-free messages referencing __blkcg_rstat_flush or blkg_release in dmesg
Unexpected kernel panics or slab corruption warnings on systems under heavy cgroup churn
Unprivileged processes performing rapid cgroup.procs writes combined with rmdir on blkio/io cgroup directories

Detection Strategies

Enable CONFIG_KASAN in test kernels to surface UAF conditions during QA or fuzzing
Correlate cgroup lifecycle syscalls (mkdir, rmdir under /sys/fs/cgroup) with subsequent kernel warnings using EDR telemetry
Alert on processes creating and destroying block cgroups at high frequency, an atypical workload pattern for production systems

Monitoring Recommendations

Ingest /var/log/kern.log and journalctl -k output into a centralized log platform and alert on BUG:, WARNING:, and general protection fault entries mentioning blk-cgroup or blkcg
Track kernel version inventory across the fleet to identify hosts running unpatched builds
Monitor container runtimes and orchestrators that expose cgroup manipulation to workloads, and flag anomalous cgroup churn

How to Mitigate CVE-2026-63802

Immediate Actions Required

Identify Linux systems running kernel versions that lack the referenced stable commits and prioritize them for patching
Apply the vendor-provided kernel update from your distribution as soon as it becomes available
Restrict unprivileged access to cgroup creation, especially in multi-tenant and container hosts

Patch Information

The upstream fix moves the rstat flush call out of the RCU callback path and into blkg_release() before call_rcu(). This guarantees the RCU grace period waits for any in-progress __blkcg_rstat_flush() executing under rcu_read_lock() on another CPU. The relevant stable tree commits are 0ab5ee5a1badb58cbb2242617cb01a4972b1f2a2, 5e5b7f2ef854936e95dceb6a2fdfefcb7152d2c6, 96e545410c4f74c89d496c1d5d9ef8d08f14368b, afebe44facc48a61761e885bbb7f0380d4a603ec, and bbebd9425cad3573d1527441753899b926525a0f. See the Linux kernel stable tree for the reference implementation.

Workarounds

Disable unprivileged user namespaces where operationally feasible by setting kernel.unprivileged_userns_clone=0
Restrict container runtime capabilities so workloads cannot create or delete block cgroups arbitrarily
Limit delegated cgroup controllers in cgroup.subtree_control to exclude io for untrusted workloads until the kernel is patched

bash

# Example: verify running kernel and disable unprivileged user namespaces
uname -r
sysctl -w kernel.unprivileged_userns_clone=0
echo 'kernel.unprivileged_userns_clone=0' | sudo tee /etc/sysctl.d/99-cve-2026-63802.conf

# Restrict io controller delegation on cgroup v2 hosts
cat /sys/fs/cgroup/cgroup.subtree_control