Linux kernel blk-cgroup: use-after-free on cgroup writeback release when the last blkcg reference drops

Impact

cgwb_release_workfn() dropped its reference with css_put(wb->blkcg_css) and then still dereferenced wb->blkcg_css through blkcg_unpin_online(). If that css_put() was the last reference, the blkcg is freed asynchronously before blkcg_unpin_online() writes to blkcg->online_pin, giving a KASAN slab-use-after-free write in a kworker. The reporter says they see this crash sporadically across multiple kernel versions on a production fleet, so this is a real stability problem, not a theoretical one. Cgroup writeback teardown runs every time a container with blkio limits goes away, which on a GPU node is every job, so the trigger rate scales with scheduling churn; the race window is narrow but it is a write to freed memory.

Who can reach it

Local and largely incidental: cgroup creation and teardown, which on these nodes is driven by the container runtime rather than by a tenant directly. A workload that can cause rapid cgroup churn makes the race more likely. No authentication boundary is crossed to reach the code; the hazard is a node crash or memory corruption during normal container teardown.

What to do

Update the host kernel to a build carrying the stable fix commits below (blkcg_unpin_online() moved before css_put()) and reboot each node. There is no configuration mitigation short of not using cgroup writeback with blkio, which is not realistic on a container node.

References

Related entries

• Linux kernel mm/filemap: nr_pages overflow in fault-around maps past the end of a large folioCVE-2026-31648 · Linux kernel mm/filemap (nr_pages overflow in filemap_map_pages)High
• Linux i915 GPU kernel driver: A use-after-free in the i915 GPU kernel driver. The general shape is that a GPU object isCVE-2026-31656 · Linux i915 GPU kernel driverHigh
• sudo: failed setuid/setgid/setgroups before running the mailer is non-fatal, allowing privilege escalationCVE-2026-35535 · sudo (privilege drop before invoking the mailer)High
• QEMU: guest-triggered out-of-bounds write when a physical memory map returns shortCVE-2026-3842 · QEMU (cpu_physical_memory_map short-mapping handling)High
• Linux kernel BPF verifier: atomic-fetch precision gap lets equivalent-looking states be prunedCVE-2026-43009 · Linux kernel BPF verifier (precision backtracking for atomic fetch instructions)High
• Linux kernel sockmap: use-after-free of sk->sk_socket when an AF_UNIX peer is orphanedCVE-2026-43016 · Linux kernel BPF sockmap (sk_psock_verdict_data_ready)High