CVE-2026-63802

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description A use-after-free issue exists in the blk-cgroup component. This occurs when multiple blkg structures within the same blkcg are released concurrently. A race condition arises when the blkcg rstat flush() function of one blkg removes the iostat entries of another blkg using llist del all(). Consequently, the second blkg may perceive the list as empty and proceed to free itself while the first is still iterating over those entries.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.