CVE-2026-90325

In the Linux kernel, the following vulnerability has been resolved:

blk-cgroup: skip dying blkg in blkcg_activate_policy()

When switching IO schedulers on a block device, blkcg_activate_policy()

can race with concurrent blkcg deletion, leading to a use-after-free in

rcu_accelerate_cbs.

T1: T2:

blkg_destroy

kill(&blkg->refcnt) // blkg->refcnt=1->0

blkg_release // call_rcu(__blkg_release)

...

blkg_free_workfn

->pd_free_fn(pd)

elv_iosched_store

elevator_switch

...

iterate blkg list

blkg_get(blkg) // blkg->refcnt=0->1

list_del_init(&blkg->q_node)

blkg_put(pinned_blkg) // blkg->refcnt=1->0

blkg_release // call_rcu again

rcu_accelerate_cbs // uaf

Fix this by checking hlist_unhashed(&blkg->blkcg_node) before getting

a reference to the blkg. This is the same check used in blkg_destroy()

to detect if a blkg has already been destroyed. If the blkg is already

unhashed, skip processing it since it's being destroyed.