CVE-2026-64017

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> blk-mq: pop cached request if it is usable<br /> <br /> When submitting a bio to blk-mq, if the task should sleep after peeking<br /> a cached request, but before it pops it, the plug flushes and calls<br /> blk_mq_free_plug_rqs, freeing the cached_rqs. This creates a<br /> use-after-free bug. Fix this by popping the cached request before any<br /> possible blocking calls if it is suitable for use.<br /> <br /> Popping this request first holds a queue reference, so avoid any<br /> serialization races with queue freezes and can safely proceed with<br /> dispatching that request to the driver. This potentially increases a<br /> timing window from when a driver wants to freeze its queue to when<br /> requests stop being dispatched. That scenario is off the fast path<br /> though, and drivers need to appropriately handle requests during a<br /> freeze request anyway.<br /> <br /> The downside is the popped element needs to be individually freed when<br /> we performed a bio plug merge. The cached request would have had to be<br /> freed later anyway, but this patch does it inline with building the plug<br /> list instead of after flushing it.