CVE-2026-93795

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-93795", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-09-18T17:59:28.789Z", "datePublished": "2026-09-24T16:02:28.654Z", "dateUpdated": "2026-10-03T10:57:30.314Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-10-03T10:57:30.314Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nblk-cgroup: fix leaks and online flag on radix_tree_insert failure\n\nWhen radix_tree_insert() fails in blkg_create(), the error path has two\nissues:\n\n1. blkg->online is set to true unconditionally, even when the blkg was\n never fully inserted. Move the assignment inside the success block.\n\n2. The error path calls blkg_put() without first calling\n percpu_ref_kill(). Because the refcount is still in percpu mode,\n percpu_ref_put() only does this_cpu_sub() without checking for zero,\n so blkg_release() is never triggered. This permanently leaks the\n blkg memory, its percpu iostat, policy data, the parent blkg\n reference, and the cgroup css reference \u2014 the latter preventing the\n cgroup from ever being destroyed.\n\nFix by replacing blkg_put() with percpu_ref_kill(), matching the pattern\nused in blkg_destroy()."}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["block/blk-cgroup.c"], "versions": [{"version": "7fcf2b033b84e261dca283bc2911aaea4b07b525", "lessThan": "0f840db042caee9d2f3dcdcf97d6674f6e4c1e30", "status": "affected", "versionType": "git"}, {"version": "7fcf2b033b84e261dca283bc2911aaea4b07b525", "lessThan": "f53945d7c712efe63fadbcc5ffed6370871fd0d3", "status": "affected", "versionType": "git"}, {"version": "7fcf2b033b84e261dca283bc2911aaea4b07b525", "lessThan": "ada8270ccdb6f212da5eb22614c28ea418746a4a", "status": "affected", "versionType": "git"}, {"version": "7fcf2b033b84e261dca283bc2911aaea4b07b525", "lessThan": "c3650be82ef6e7af13b79b2d10a7363bdf54aa7f", "status": "affected", "versionType": "git"}, {"version": "7fcf2b033b84e261dca283bc2911aaea4b07b525", "lessThan": "6e85f02d45b5977c0326a8d854c6db878aa6b34a", "status": "affected", "versionType": "git"}, {"version": "7fcf2b033b84e261dca283bc2911aaea4b07b525", "lessThan": "4c0d150fb98ea40760611979f4e664c244b20966", "status": "affected", "versionType": "git"}, {"version": "7fcf2b033b84e261dca283bc2911aaea4b07b525", "lessThan": "dbbca20764382b4d411ec2918f4e278ffe547acc", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["block/blk-cgroup.c"], "versions": [{"version": "5.0", "status": "affected"}, {"version": "0", "lessThan": "5.0", "status": "unaffected", "versionType": "semver"}, {"version": "5.10.271", "lessThanOrEqual": "5.10.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.15.222", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.189", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.158", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.111", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.53", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.0", "versionEndExcluding": "5.10.271"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.0", "versionEndExcluding": "5.15.222"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.0", "versionEndExcluding": "6.1.189"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.0", "versionEndExcluding": "6.6.158"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.0", "versionEndExcluding": "6.12.111"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.0", "versionEndExcluding": "6.18.53"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.0", "versionEndExcluding": "7.2"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/0f840db042caee9d2f3dcdcf97d6674f6e4c1e30"}, {"url": "https://git.kernel.org/stable/c/f53945d7c712efe63fadbcc5ffed6370871fd0d3"}, {"url": "https://git.kernel.org/stable/c/ada8270ccdb6f212da5eb22614c28ea418746a4a"}, {"url": "https://git.kernel.org/stable/c/c3650be82ef6e7af13b79b2d10a7363bdf54aa7f"}, {"url": "https://git.kernel.org/stable/c/6e85f02d45b5977c0326a8d854c6db878aa6b34a"}, {"url": "https://git.kernel.org/stable/c/4c0d150fb98ea40760611979f4e664c244b20966"}, {"url": "https://git.kernel.org/stable/c/dbbca20764382b4d411ec2918f4e278ffe547acc"}], "title": "blk-cgroup: fix leaks and online flag on radix_tree_insert failure", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["block/blk-cgroup.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "0f840db042caee9d2f3dcdcf97d6674f6e4c1e30", "status": "affected", "version": "7fcf2b033b84e261dca283bc2911aaea4b07b525", "versionType": "git"}, {"lessThan": "f53945d7c712efe63fadbcc5ffed6370871fd0d3", "status": "affected", "version": "7fcf2b033b84e261dca283bc2911aaea4b07b525", "versionType": "git"}, {"lessThan": "ada8270ccdb6f212da5eb22614c28ea418746a4a", "status": "affected", "version": "7fcf2b033b84e261dca283bc2911aaea4b07b525", "versionType": "git"}, {"lessThan": "c3650be82ef6e7af13b79b2d10a7363bdf54aa7f", "status": "affected", "version": "7fcf2b033b84e261dca283bc2911aaea4b07b525", "versionType": "git"}, {"lessThan": "6e85f02d45b5977c0326a8d854c6db878aa6b34a", "status": "affected", "version": "7fcf2b033b84e261dca283bc2911aaea4b07b525", "versionType": "git"}, {"lessThan": "4c0d150fb98ea40760611979f4e664c244b20966", "status": "affected", "version": "7fcf2b033b84e261dca283bc2911aaea4b07b525", "versionType": "git"}, {"lessThan": "dbbca20764382b4d411ec2918f4e278ffe547acc", "status": "affected", "version": "7fcf2b033b84e261dca283bc2911aaea4b07b525", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["block/blk-cgroup.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "5.0"}, {"lessThan": "5.0", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "5.10.*", "status": "unaffected", "version": "5.10.271", "versionType": "semver"}, {"lessThanOrEqual": "5.15.*", "status": "unaffected", "version": "5.15.222", "versionType": "semver"}, {"lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.189", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.158", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.111", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.53", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.2", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nblk-cgroup: fix leaks and online flag on radix_tree_insert failure\n\nWhen radix_tree_insert() fails in blkg_create(), the error path has two\nissues:\n\n1. blkg->online is set to true unconditionally, even when the blkg was\n never fully inserted. Move the assignment inside the success block.\n\n2. The error path calls blkg_put() without first calling\n percpu_ref_kill(). Because the refcount is still in percpu mode,\n percpu_ref_put() only does this_cpu_sub() without checking for zero,\n so blkg_release() is never triggered. This permanently leaks the\n blkg memory, its percpu iostat, policy data, the parent blkg\n reference, and the cgroup css reference \u2014 the latter preventing the\n cgroup from ever being destroyed.\n\nFix by replacing blkg_put() with percpu_ref_kill(), matching the pattern\nused in blkg_destroy()."}], "id": "CVE-2026-93795", "lastModified": "2026-10-03T11:17:49.107", "metrics": {}, "published": "2026-09-24T17:17:12.270", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/0f840db042caee9d2f3dcdcf97d6674f6e4c1e30"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/4c0d150fb98ea40760611979f4e664c244b20966"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/6e85f02d45b5977c0326a8d854c6db878aa6b34a"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/ada8270ccdb6f212da5eb22614c28ea418746a4a"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/c3650be82ef6e7af13b79b2d10a7363bdf54aa7f"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/dbbca20764382b4d411ec2918f4e278ffe547acc"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/f53945d7c712efe63fadbcc5ffed6370871fd0d3"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{"bugzilla": {"description": "kernel: blk-cgroup: fix leaks and online flag on radix_tree_insert failure", "id": "2540384", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2540384"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-772", "details": ["In the Linux kernel, the following vulnerability has been resolved:\nblk-cgroup: fix leaks and online flag on radix_tree_insert failure\nWhen radix_tree_insert() fails in blkg_create(), the error path has two\nissues:\n1. blkg->online is set to true unconditionally, even when the blkg was\nnever fully inserted. Move the assignment inside the success block.\n2. The error path calls blkg_put() without first calling\npercpu_ref_kill(). Because the refcount is still in percpu mode,\npercpu_ref_put() only does this_cpu_sub() without checking for zero,\nso blkg_release() is never triggered. This permanently leaks the\nblkg memory, its percpu iostat, policy data, the parent blkg\nreference, and the cgroup css reference \u2014 the latter preventing the\ncgroup from ever being destroyed.\nFix by replacing blkg_put() with percpu_ref_kill(), matching the pattern\nused in blkg_destroy().", "A flaw was found in the Linux kernel's block control group (blk-cgroup) subsystem, which can lead to a Denial of Service (DoS). When an insertion failure occurs during the creation of a block group structure, the error-handling path fails to properly shut down reference counting. A local user can exploit this vulnerability to permanently leak memory and internal references, preventing affected control groups from being destroyed and exhausting system resources."], "name": "CVE-2026-93795", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Out of support scope", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Fix deferred", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Fix deferred", "package_name": "openshift/ose-rhel-coreos-8", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Fix deferred", "package_name": "openshift/ose-rhel-coreos-9", "product_name": "Red Hat OpenShift Container Platform 4"}], "public_date": "2026-09-24T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-93795\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-93795\nhttps://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-93795.mbox"], "threat_severity": "Low"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,6e85f02d45b5977c0326a8d854c6db878aa6b34a)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,4c0d150fb98ea40760611979f4e664c244b20966)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,dbbca20764382b4d411ec2918f4e278ffe547acc)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,6.12.111)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,6.18.53)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.12.111,6.13.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.53,6.19.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.2,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-09-24T20:00:11.014145+00:00", "updated": "2026-10-01T20:15:12.382223+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}