CVE-2026-98820

In the Linux kernel, the following vulnerability has been resolved:

blk-mq: set RQF USE SCHED when the operation is known

The cached requests are allocated for one operation but can be handed out for another. A passthrough command has RQF USE SCHED cleared, so using those flags for a subsequent read/write bio will insert it into the scheduler without ->prepare request() and frees it without ->finish request(). For kyber, this leaks the domain token acquired at dispatch and stalls the queue.

Don't set RQF USE SCHED based on the first operation the batch happened to be allocated for. Instead, set it after the request is claimed by an operation. Introduce a helper function, blk mq rq late init() for this, and absorb blk mq rq time init() since the two run together.