CVE-2026-98820

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-98820", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-09-25T10:25:14.372Z", "datePublished": "2026-10-18T15:49:12.251Z", "dateUpdated": "2026-10-19T09:26:13.210Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-10-19T09:26:13.210Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nblk-mq: set RQF_USE_SCHED when the operation is known\n\nThe cached requests are allocated for one operation but can be handed\nout for another. A passthrough command has RQF_USE_SCHED cleared, so\nusing those flags for a subsequent read/write bio will insert it into\nthe scheduler without ->prepare_request() and frees it without\n->finish_request(). For kyber, this leaks the domain token acquired at\ndispatch and stalls the queue.\n\nDon't set RQF_USE_SCHED based on the first operation the batch happened\nto be allocated for. Instead, set it after the request is claimed by an\noperation. Introduce a helper function, blk_mq_rq_late_init() for this,\nand absorb blk_mq_rq_time_init() since the two run together."}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["block/blk-mq.c", "block/mq-deadline.c"], "versions": [{"version": "4b6a5d9cea911424e84107df8c4eb8317938d2cd", "lessThan": "790730e4d95de8356a573d4b4864486bba731863", "status": "affected", "versionType": "git"}, {"version": "4b6a5d9cea911424e84107df8c4eb8317938d2cd", "lessThan": "2c47ebc27fa72078e26177cd458cdaf3006a9685", "status": "affected", "versionType": "git"}, {"version": "4b6a5d9cea911424e84107df8c4eb8317938d2cd", "lessThan": "ab6c756f28c741d704a7c3e04814bfc3adf6f818", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["block/blk-mq.c", "block/mq-deadline.c"], "versions": [{"version": "6.1", "status": "affected"}, {"version": "0", "lessThan": "6.1", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.56", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2.10", "lessThanOrEqual": "7.2.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.3", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.1", "versionEndExcluding": "6.18.56"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.1", "versionEndExcluding": "7.2.10"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.1", "versionEndExcluding": "7.3"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/790730e4d95de8356a573d4b4864486bba731863"}, {"url": "https://git.kernel.org/stable/c/2c47ebc27fa72078e26177cd458cdaf3006a9685"}, {"url": "https://git.kernel.org/stable/c/ab6c756f28c741d704a7c3e04814bfc3adf6f818"}], "title": "blk-mq: set RQF_USE_SCHED when the operation is known", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["block/blk-mq.c", "block/mq-deadline.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "790730e4d95de8356a573d4b4864486bba731863", "status": "affected", "version": "4b6a5d9cea911424e84107df8c4eb8317938d2cd", "versionType": "git"}, {"lessThan": "2c47ebc27fa72078e26177cd458cdaf3006a9685", "status": "affected", "version": "4b6a5d9cea911424e84107df8c4eb8317938d2cd", "versionType": "git"}, {"lessThan": "ab6c756f28c741d704a7c3e04814bfc3adf6f818", "status": "affected", "version": "4b6a5d9cea911424e84107df8c4eb8317938d2cd", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["block/blk-mq.c", "block/mq-deadline.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "6.1"}, {"lessThan": "6.1", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.56", "versionType": "semver"}, {"lessThanOrEqual": "7.2.*", "status": "unaffected", "version": "7.2.10", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.3", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nblk-mq: set RQF_USE_SCHED when the operation is known\n\nThe cached requests are allocated for one operation but can be handed\nout for another. A passthrough command has RQF_USE_SCHED cleared, so\nusing those flags for a subsequent read/write bio will insert it into\nthe scheduler without ->prepare_request() and frees it without\n->finish_request(). For kyber, this leaks the domain token acquired at\ndispatch and stalls the queue.\n\nDon't set RQF_USE_SCHED based on the first operation the batch happened\nto be allocated for. Instead, set it after the request is claimed by an\noperation. Introduce a helper function, blk_mq_rq_late_init() for this,\nand absorb blk_mq_rq_time_init() since the two run together."}], "id": "CVE-2026-98820", "lastModified": "2026-10-19T10:19:46.087", "metrics": {}, "published": "2026-10-18T16:17:36.240", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/2c47ebc27fa72078e26177cd458cdaf3006a9685"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/790730e4d95de8356a573d4b4864486bba731863"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/ab6c756f28c741d704a7c3e04814bfc3adf6f818"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{"bugzilla": {"description": "kernel: blk-mq: set RQF_USE_SCHED when the operation is known", "id": "2555238", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2555238"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-772", "details": ["In the Linux kernel, the following vulnerability has been resolved:\nblk-mq: set RQF_USE_SCHED when the operation is known\nThe cached requests are allocated for one operation but can be handed\nout for another. A passthrough command has RQF_USE_SCHED cleared, so\nusing those flags for a subsequent read/write bio will insert it into\nthe scheduler without ->prepare_request() and frees it without\n->finish_request(). For kyber, this leaks the domain token acquired at\ndispatch and stalls the queue.\nDon't set RQF_USE_SCHED based on the first operation the batch happened\nto be allocated for. Instead, set it after the request is claimed by an\noperation. Introduce a helper function, blk_mq_rq_late_init() for this,\nand absorb blk_mq_rq_time_init() since the two run together.", "A flaw was found in the Linux kernel's block multi-queue (blk-mq) subsystem. When cached input/output (I/O) requests originally allocated for passthrough commands are reused for standard read or write operations, scheduler flags are not properly updated. This failure bypasses required scheduler initialization and cleanup routines, leading to internal resource leaks in certain I/O schedulers like Kyber. A local attacker could exploit this flaw to stall storage queues, resulting in a Denial of Service (DoS)."], "name": "CVE-2026-98820", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Not affected", "package_name": "openshift/ose-rhel-coreos-8", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Fix deferred", "package_name": "openshift/ose-rhel-coreos-9", "product_name": "Red Hat OpenShift Container Platform 4"}], "public_date": "2026-10-18T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-98820\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-98820\nhttps://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-98820.mbox"], "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[4b6a5d9cea911424e84107df8c4eb8317938d2cd,790730e4d95de8356a573d4b4864486bba731863)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[4b6a5d9cea911424e84107df8c4eb8317938d2cd,2c47ebc27fa72078e26177cd458cdaf3006a9685)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[4b6a5d9cea911424e84107df8c4eb8317938d2cd,ab6c756f28c741d704a7c3e04814bfc3adf6f818)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "6.1"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[0,6.1)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.56,6.19.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.2.10,7.3.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.3,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-10-18T21:30:14.253643+00:00", "updated": "2026-10-24T03:30:15.424200+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}