CVE-2026-64017: Linux Kernel Use-After-Free Vulnerability

CVE-2026-64017 Overview

CVE-2026-64017 is a use-after-free vulnerability in the Linux kernel's block multi-queue (blk-mq) subsystem. The flaw occurs when submitting a bio to blk-mq. If the submitting task sleeps after peeking a cached request but before popping it, the plug flushes and calls blk_mq_free_plug_rqs, freeing the cached_rqs structure. Subsequent use of the freed request produces a use-after-free condition [CWE-416]. Local, authenticated attackers can exploit this condition to compromise kernel memory integrity and potentially escalate privileges.

Critical Impact
A local attacker with low privileges can trigger a use-after-free in the block layer, impacting confidentiality, integrity, and availability of the affected system.

Affected Products

Linux kernel versions containing the vulnerable blk-mq plug caching logic prior to the referenced upstream commits
Distributions shipping the affected mainline kernel releases
Systems using block multi-queue I/O submission paths

Discovery Timeline

2026-07-19 - CVE-2026-64017 published to NVD
2026-07-20 - Last updated in NVD database

Technical Details for CVE-2026-64017

Vulnerability Analysis

The vulnerability resides in the block multi-queue submission path. When a task submits a bio, the kernel peeks at a cached request from the current plug before dispatching it. If the task blocks between peeking and popping the request, the plug is flushed and blk_mq_free_plug_rqs releases the cached request memory. When execution resumes, the code accesses the freed request, producing a use-after-free.

Exploitation of use-after-free conditions in the block layer can lead to kernel memory corruption. An attacker controlling the freed slab object can influence subsequent kernel allocations to hijack control flow or corrupt kernel structures.

Root Cause

The root cause is an ordering error: the cached request is peeked but not popped before a call that may sleep. Sleeping allows the plug flush path to free the cached request list while a stale reference remains on the submission path. The fix pops the usable cached request before any potentially blocking call, holding a queue reference for the duration of dispatch.

Attack Vector

The attack vector is local. An unprivileged user process that issues I/O operations against a block device can drive the kernel through the vulnerable submission path. Triggering the race requires forcing the task to sleep between the peek and pop operations, which can be induced through memory pressure or contention on the request queue. Reliable exploitation depends on winning the race between cached request access and plug flush.

No verified public proof-of-concept exploit code is available. Refer to the upstream commits 388468f7e7d1 and dc278e9bf2b9 for the corrective changes.

Detection Methods for CVE-2026-64017

Indicators of Compromise

Unexpected kernel oops or panic messages referencing blk_mq_free_plug_rqs, blk_mq_submit_bio, or KASAN use-after-free reports in the block layer
Kernel logs showing slab corruption or general protection faults during heavy I/O workloads
Unexplained crashes on systems running unpatched kernel versions under I/O-intensive workloads

Detection Strategies

Enable Kernel Address Sanitizer (KASAN) in test environments to catch use-after-free access in blk-mq paths
Monitor dmesg and journalctl for kernel BUG, WARN, or KASAN reports referencing block layer functions
Track kernel version inventory to identify hosts running vulnerable kernel builds

Monitoring Recommendations

Aggregate kernel crash telemetry from endpoints and correlate spikes in block-layer faults across the fleet
Alert on repeated kernel panics or unexpected reboots on servers with high I/O throughput
Track patch deployment status against the upstream commits referenced in the advisory

How to Mitigate CVE-2026-64017

Immediate Actions Required

Update affected Linux kernels to a version that includes commits 388468f7e7d1eab092cf2a39fdfb502e52019ec6 and dc278e9bf2b9513a763353e6b9cc21e0f532954e
Apply distribution vendor kernel updates as soon as they are released for your Linux distribution
Restrict local shell access on multi-tenant systems until patches are deployed

Patch Information

The upstream fix pops the cached request before any potentially blocking call when the request is suitable for use. This ensures a queue reference is held and eliminates the race with plug flush. Patch details are available in the Kernel Git Commit 388468f7e7d1 and Kernel Git Commit dc278e9bf2b9.

Workarounds

No official workaround is available; apply the kernel patch as the primary remediation
Limit untrusted local access on shared systems to reduce the attack surface
Enforce least-privilege policies for local user accounts and container workloads that access block devices

bash

# Verify kernel version and patch status
uname -r
# Update kernel using distribution package manager
# Debian/Ubuntu
sudo apt update && sudo apt install --only-upgrade linux-image-$(uname -r)
# RHEL/CentOS/Fedora
sudo dnf update kernel
# Reboot to apply the new kernel
sudo reboot