CVE-2026-23374

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> blktrace: fix __this_cpu_read/write in preemptible context<br /> <br /> tracing_record_cmdline() internally uses __this_cpu_read() and<br /> __this_cpu_write() on the per-CPU variable trace_cmdline_save, and<br /> trace_save_cmdline() explicitly asserts preemption is disabled via<br /> lockdep_assert_preemption_disabled(). These operations are only safe<br /> when preemption is off, as they were designed to be called from the<br /> scheduler context (probe_wakeup_sched_switch() / probe_wakeup()).<br /> <br /> __blk_add_trace() was calling tracing_record_cmdline(current) early in<br /> the blk_tracer path, before ring buffer reservation, from process<br /> context where preemption is fully enabled. This triggers the following<br /> using blktests/blktrace/002:<br /> <br /> blktrace/002 (blktrace ftrace corruption with sysfs trace) [failed]<br /> runtime 0.367s ... 0.437s<br /> something found in dmesg:<br /> [ 81.211018] run blktests blktrace/002 at 2026-02-25 22:24:33<br /> [ 81.239580] null_blk: disk nullb1 created<br /> [ 81.357294] BUG: using __this_cpu_read() in preemptible [00000000] code: dd/2516<br /> [ 81.362842] caller is tracing_record_cmdline+0x10/0x40<br /> [ 81.362872] CPU: 16 UID: 0 PID: 2516 Comm: dd Tainted: G N 7.0.0-rc1lblk+ #84 PREEMPT(full)<br /> [ 81.362877] Tainted: [N]=TEST<br /> [ 81.362878] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.17.0-0-gb52ca86e094d-prebuilt.qemu.org 04/01/2014<br /> [ 81.362881] Call Trace:<br /> [ 81.362884] <br /> [ 81.362886] dump_stack_lvl+0x8d/0xb0<br /> ...<br /> (See &amp;#39;/mnt/sda/blktests/results/nodev/blktrace/002.dmesg&amp;#39; for the entire message)<br /> <br /> [ 81.211018] run blktests blktrace/002 at 2026-02-25 22:24:33<br /> [ 81.239580] null_blk: disk nullb1 created<br /> [ 81.357294] BUG: using __this_cpu_read() in preemptible [00000000] code: dd/2516<br /> [ 81.362842] caller is tracing_record_cmdline+0x10/0x40<br /> [ 81.362872] CPU: 16 UID: 0 PID: 2516 Comm: dd Tainted: G N 7.0.0-rc1lblk+ #84 PREEMPT(full)<br /> [ 81.362877] Tainted: [N]=TEST<br /> [ 81.362878] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.17.0-0-gb52ca86e094d-prebuilt.qemu.org 04/01/2014<br /> [ 81.362881] Call Trace:<br /> [ 81.362884] <br /> [ 81.362886] dump_stack_lvl+0x8d/0xb0<br /> [ 81.362895] check_preemption_disabled+0xce/0xe0<br /> [ 81.362902] tracing_record_cmdline+0x10/0x40<br /> [ 81.362923] __blk_add_trace+0x307/0x5d0<br /> [ 81.362934] ? lock_acquire+0xe0/0x300<br /> [ 81.362940] ? iov_iter_extract_pages+0x101/0xa30<br /> [ 81.362959] blk_add_trace_bio+0x106/0x1e0<br /> [ 81.362968] submit_bio_noacct_nocheck+0x24b/0x3a0<br /> [ 81.362979] ? lockdep_init_map_type+0x58/0x260<br /> [ 81.362988] submit_bio_wait+0x56/0x90<br /> [ 81.363009] __blkdev_direct_IO_simple+0x16c/0x250<br /> [ 81.363026] ? __pfx_submit_bio_wait_endio+0x10/0x10<br /> [ 81.363038] ? rcu_read_lock_any_held+0x73/0xa0<br /> [ 81.363051] blkdev_read_iter+0xc1/0x140<br /> [ 81.363059] vfs_read+0x20b/0x330<br /> [ 81.363083] ksys_read+0x67/0xe0<br /> [ 81.363090] do_syscall_64+0xbf/0xf00<br /> [ 81.363102] entry_SYSCALL_64_after_hwframe+0x76/0x7e<br /> [ 81.363106] RIP: 0033:0x7f281906029d<br /> [ 81.363111] Code: 31 c0 e9 c6 fe ff ff 50 48 8d 3d 66 63 0a 00 e8 59 ff 01 00 66 0f 1f 84 00 00 00 00 00 80 3d 41 33 0e 00 00 74 17 31 c0 0f 05 3d 00 f0 ff ff 77 5b c3 66 2e 0f 1f 84 00 00 00 00 00 48 83 ec<br /> [ 81.363113] RSP: 002b:00007ffca127dd48 EFLAGS: 00000246 ORIG_RAX: 0000000000000000<br /> [ 81.363120] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f281906029d<br /> [ 81.363122] RDX: 0000000000001000 RSI: 0000559f8bfae000 RDI: 0000000000000000<br /> [ 81.363123] RBP: 0000000000001000 R08: 0000002863a10a81 R09: 00007f281915f000<br /> [ 81.363124] R10: 00007f2818f77b60 R11: 0000000000000246 R12: 0000559f8bfae000<br /> [ 81.363126] R13: 0000000000000000 R14: 0000000000000000 R15: 000000000000000a<br /> [ 81.363142] <br /> <br /> The same BUG fires from blk_add_trace_plug(), blk_add_trace_unplug(),<br /> and blk_add_trace_rq() paths as well.<br /> <br /> The purpose of tracin<br /> ---truncated---