CVE-2026-64326

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description An issue exists in the block layer where the bdev mark dead() function fails to check the surprise variable when handling bare block devices. When surprise is set to true, it indicates the device is already gone. However, the system unconditionally calls sync blockdev(), which can lead to an infinite hang while waiting for writeback operations that cannot complete. This can be triggered via the nvme reset work() path through the following sequence: nvme mark namespaces dead() -> blk mark disk dead() -> bdev mark dead(bdev, true) -> sync blockdev(), which then blocks in folio wait writeback(), stalling the reset worker and all dependent tasks.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.