CVE-2026-64509 Overview
CVE-2026-64509 is a resource management flaw in the Linux kernel's Rust block layer bindings. The vulnerability affects GenDiskBuilder::build(), which performs fallible work after __blk_mq_alloc_disk() but only partially cleans up on failure. The error path recovers foreign queue data yet leaks the temporary gendisk and request_queue references.
If the caller transferred the last Arc<TagSet<T>> into build(), the leaked queue can retain blk-mq state after the tag set is dropped. A second defect exists in GenDisk::drop(), which fails to call put_disk() after del_gendisk(), leaving the final reference held.
Critical Impact
The flaw causes memory leaks and potential use-after-free conditions when block device registration fails or when Rust-based GenDisk objects are released.
Affected Products
- Linux kernel versions containing the Rust block device abstractions
- Kernel builds enabling Rust block driver support (CONFIG_RUST with block subsystem bindings)
- Distributions shipping stable kernels prior to the fixing commits
Discovery Timeline
- 2026-07-25 - CVE-2026-64509 published to NVD
- 2026-07-25 - Last updated in NVD database
Technical Details for CVE-2026-64509
Vulnerability Analysis
The defect resides in the Rust bindings for the Linux block layer. GenDiskBuilder::build() calls __blk_mq_alloc_disk() to allocate a gendisk and its associated request_queue. Additional fallible operations follow that allocation. When those operations fail, the error path recovers only the foreign queue data instead of releasing the freshly allocated disk.
The temporary gendisk reference remains alive, which prevents disk_release() from tearing down the owned queue. Separately, GenDisk::drop() invokes del_gendisk() without a matching put_disk(). After a Rust GenDisk has been added with device_add_disk(), del_gendisk() only unregisters it; the final gendisk reference must still be dropped to complete the release path.
Root Cause
The root cause is incorrect reference counting in the Rust block layer's cleanup logic. Kernel gendisk objects follow a specific acquire/release protocol requiring put_disk() to drop the final reference. The Rust abstraction omits this call in both the pre-registration failure path and the standard drop path.
Attack Vector
Exploitation requires a Rust-based block driver to hit the failure path in GenDiskBuilder::build() or to complete a normal drop cycle after device_add_disk(). This is not a network-reachable vulnerability. The impact is limited to memory exhaustion, resource leakage, and stale blk-mq state that can outlive its owning tag set.
See the upstream fix in Kernel Git Commit d1dcaa52 and related backports for technical details.
Fix Summary
The patch drops the temporary gendisk reference with put_disk() before recovering queue_data in the pre-registration failure path. It also pairs GenDisk::drop() with put_disk() after del_gendisk() so the owned queue is torn down correctly.
Detection Methods for CVE-2026-64509
Indicators of Compromise
- Unexpected growth in kernel slab allocations associated with blk_mq or request_queue objects on hosts running Rust block drivers.
- Kernel warnings from the block subsystem referencing dangling gendisk or request_queue references after driver load failures.
- dmesg entries showing repeated driver initialization failures without corresponding cleanup messages.
Detection Strategies
- Inventory kernel builds to identify systems compiled with Rust block layer support and correlate them against fixed stable kernel versions.
- Review /proc/slabinfo and /sys/kernel/slab/ for abnormal counts of blk_mq_ctx, request_queue, or related caches on affected hosts.
- Monitor kernel logs for repeated block driver probe failures that may trigger the leaking error path.
Monitoring Recommendations
- Track kernel memory pressure trends on hosts using experimental Rust drivers.
- Alert on kernel WARN_ON traces originating from blk-mq or disk_release code paths.
- Include kernel package versions in configuration management baselines to detect unpatched systems.
How to Mitigate CVE-2026-64509
Immediate Actions Required
- Apply the latest stable kernel updates from your distribution that include the referenced commits.
- Identify hosts running Rust-based block drivers and prioritize them for patching.
- Reboot affected systems after kernel replacement to load the corrected GenDisk cleanup logic.
Patch Information
The fix is available in the mainline and stable Linux kernel trees through the following commits: Kernel Git Commit 29577713, Kernel Git Commit 6822a26, Kernel Git Commit d1dcaa52, and Kernel Git Commit e7636f26. Consult your distribution's security tracker for backported package versions.
Workarounds
- Disable or avoid loading Rust-based block drivers on production systems until the patched kernel is deployed.
- Rebuild custom kernels with CONFIG_RUST block driver support disabled if patching is not immediately feasible.
- Restrict privileged operations that can trigger repeated block device registration and teardown on unpatched hosts.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
