CVE-2026-98832

In the Linux kernel, the following vulnerability has been resolved:

blk-cgroup: save IRQ state in blkg tryget closest()

bio set dev() associates the bio with a blkg through bio associate blkg(). If the blkg lookup misses, blkg tryget closest() takes q->queue lock with spin lock irq() and releases it with spin unlock irq(), which unconditionally enables local interrupts.

Callers may call bio set dev() with interrupts already disabled, e.g. dm-thin's pool map() does so while holding pool->lock taken with spin lock irq(). The nested spin unlock irq() then enables interrupts while pool->lock is still held, so an I/O completion softirq can run on the same CPU, re-acquire pool->lock (thin endio(), or overwrite endio() -> complete mapping preparation()) and deadlock. lockdep reports this as inconsistent SOFTIRQ-ON-W to IN-SOFTIRQ-W usage.

Commit 3a762de55b4e ("block: save irq state in blkg lookup create()") fixed the same problem while the lock lived in blkg lookup create(), but commit 9327a865e395 ("blk-cgroup: don't nest queue lock under rcu in blkg lookup create()") moved the locking into blkg tryget closest() and reverted it to spin lock irq().

Save and restore the caller's IRQ state instead.