CVE-2026-90183blk-iolatency: clear delay state when freeing policy data
- —Not scoredno CVSS score yet
- 0.21%Exploitation in 30 daysEPSS · top 89% of all CVEs
- NoKnown exploitednot in CISA's KEV catalog
- NonePublic exploitsnone known yet
Description
In the Linux kernel, the following vulnerability has been resolved: blk-iolatency: clear delay state when freeing policy data io.latency can throttle a group which has no latency target of its own. When a sibling misses its target, check_scale_change() scales down its peers, and a peer that reaches queue depth one gets blkcg_use_delay() called on it on every further scale-down, even with min_lat_nsec == 0. iolatency_pd_offline() resets the target through iolatency_set_min_lat_nsec(), which clears the delay only on a nonzero to zero transition, so it never clears such a peer. Freeing the policy data then leaves blkg->use_delay set and blkcg->congestion_count elevated with nothing left that can drop it. blk_cgroup_congested() then returns true for every task in that cgroup and its descendants for as long as the cgroup lives: page_cache_sync_ra() cuts readahead to a single page, page_cache_async_ra() skips it altogether, and __folio_throttle_swaprate() takes swap_avail_lock and schedules a throttle on anonymous folio allocation. Clear the delay in iolatency_pd_free(). By then bio-held blkg references have drained, or the queue is frozen for policy deactivation, so check_scale_change() cannot re-arm it. The free callback can also see policy data which was never attached to a blkg, hence the pd->blkg check.
Timeline
ID reserved
By Linux
- 6 days later
· 6 days later
Published
- 43 days later
· 43 days later
Record updated
Changes after publication (a new score, a public exploit, EPSS crossing 1, 10 or 50 %, leaving KEV) are kept since November 2026; earlier ones are not known.
Scores
No CVSS score yet: neither the CNA, CISA nor NVD has scored this CVE. NVD status: Received.
- EPSS (exploitation in 30 days)
- 0.21% · top 89% of all CVEs (14 Nov 2026)
The list uses the assigner's score when there is one, then CISA's, then NVD's: Not scored.
Affected products
- affected d70675121546c35feaceebf7ed9caed8716640f3 – < 27573278b1cbc2313ebd31309ac18ac6179b828a
- affected d70675121546c35feaceebf7ed9caed8716640f3 – < 53ccb4b967edc5f82ff6f9c066fb96c31aa7561a
- affected d70675121546c35feaceebf7ed9caed8716640f3 – < b6449a915d1826e1450f6368fc379fe44caa06ca
- affected d70675121546c35feaceebf7ed9caed8716640f3 – < 5c6593422eb3c3a21505436ccf74599a433584c8
- affected d70675121546c35feaceebf7ed9caed8716640f3 – < 02f1b90ab33ef99c89dd96a385b432ff57abc64d
- affected d70675121546c35feaceebf7ed9caed8716640f3 – < 8935bf22c0a0db517a7f72f7097300e05dd852f5
- affected 4.19
- unaffected < 4.19
- unaffected 6.1.191 – ≤ 6.1.*
- unaffected 6.6.160 – ≤ 6.6.*
- unaffected 6.12.114 – ≤ 6.12.*
- unaffected 6.18.57 – ≤ 6.18.*
- unaffected 7.2.6 – ≤ 7.2.*
- unaffected 7.3 – ≤ *
References
References6
- https://git.kernel.org/stable/c/27573278b1cbc2313ebd31309ac18ac6179b828a (opens in a new tab)
- https://git.kernel.org/stable/c/53ccb4b967edc5f82ff6f9c066fb96c31aa7561a (opens in a new tab)
- https://git.kernel.org/stable/c/b6449a915d1826e1450f6368fc379fe44caa06ca (opens in a new tab)
- https://git.kernel.org/stable/c/5c6593422eb3c3a21505436ccf74599a433584c8 (opens in a new tab)
- https://git.kernel.org/stable/c/02f1b90ab33ef99c89dd96a385b432ff57abc64d (opens in a new tab)
- https://git.kernel.org/stable/c/8935bf22c0a0db517a7f72f7097300e05dd852f5 (opens in a new tab)
Sources
The same CVE in the primary databases and aggregators, to check against.
- CVE.org record (opens in a new tab)
- CVE List JSON (GitHub) (opens in a new tab)
- NVD (opens in a new tab)
- FIRST EPSS (opens in a new tab)
- EUVD EUVD-2026-81776 (opens in a new tab)
- OSV.dev (opens in a new tab)
- GitHub Advisories (opens in a new tab)
- CIRCL Vulnerability-Lookup (opens in a new tab)
Badge for a README or a ticket
[](https://cveledger.app/cve/CVE-2026-90183)Record last updated .