CVE-2026-64017

In the Linux kernel, the following vulnerability has been resolved:

blk-mq: pop cached request if it is usable

When submitting a bio to blk-mq, if the task should sleep after peeking

a cached request, but before it pops it, the plug flushes and calls

blk_mq_free_plug_rqs, freeing the cached_rqs. This creates a

use-after-free bug. Fix this by popping the cached request before any

possible blocking calls if it is suitable for use.

Popping this request first holds a queue reference, so avoid any

serialization races with queue freezes and can safely proceed with

dispatching that request to the driver. This potentially increases a

timing window from when a driver wants to freeze its queue to when

requests stop being dispatched. That scenario is off the fast path

though, and drivers need to appropriately handle requests during a

freeze request anyway.

The downside is the popped element needs to be individually freed when

we performed a bio plug merge. The cached request would have had to be

freed later anyway, but this patch does it inline with building the plug

list instead of after flushing it.