CVE-2026-53126: Linux Kernel Block I/O Cgroup Disk Reference Leak

Technical summary

CVE-2026-53126 is a resource leak vulnerability in the blkcg_maybe_throttle_current() function within the Linux kernel's block cgroup subsystem. The function acquires a disk reference via get_device() during blkcg_schedule_throttle() but fails to release it when any of three error conditions occur: blkcg lookup failure, blkg lookup failure, or blkg_tryget() failure. When these conditions are met, execution jumps to the error path (out label) which only calls rcu_read_unlock() but omits the corresponding put_disk() call. Since current->throttle_disk is cleared before the failed lookup attempts, the blkcg_exit() cleanup path cannot recover the leaked reference either. This issue is a regression from an earlier refactor that converted internal structures from request_queue to gendisk.

Business impact

While local in nature, this vulnerability poses a gradual degradation risk to system stability. Long-running systems or workloads that frequently trigger blkg lookups or blkg_tryget() failures will accumulate orphaned disk references, consuming kernel memory. Over time, this can lead to denial of service through memory exhaustion, affecting services dependent on stable kernel memory availability. Systems with heavy I/O throttling policies or cgroup management are most susceptible to accelerated resource depletion.

Affected systems

This vulnerability affects the Linux kernel. The specific version range is not detailed in the advisory; however, it represents a regression introduced during a refactor that migrated from request_queue to gendisk internal structures. Systems running vulnerable kernel versions with active I/O cgroup throttling policies or dynamic cgroup management are at risk. Verify your kernel version against the vendor advisory and patch releases.

Exploitability

Exploitation requires local access and the ability to trigger the error path in blkcg_maybe_throttle_current(). This is not a remotely exploitable vulnerability. An attacker with local user privileges could potentially accelerate memory exhaustion by crafting workloads that repeatedly trigger blkg lookup failures or blkg_tryget() race conditions, but the primary risk is unintended resource depletion through normal system operation under specific I/O throttling conditions. No known public exploits exist.

Remediation

Apply a kernel patch that restores the missing put_disk() call on the error path in blkcg_maybe_throttle_current(). This is typically a single-line or minimal change to add the reference release before the rcu_read_unlock() at the out label. Check your Linux distribution's security advisory and kernel repository for the patched version applicable to your kernel branch (stable, LTS, or distribution-specific).

Patch guidance

Obtain the patched kernel version from your Linux distribution's official repository or from kernel.org. The fix is a straightforward addition of put_disk() to the error handling path and should be included in subsequent stable kernel releases following the vulnerability disclosure. Test the patched kernel in a non-production environment first to ensure compatibility with your I/O workload. Systems with intensive cgroup-based throttling policies should prioritize patching due to higher risk of hitting the error path.

Detection guidance

Monitor kernel memory usage patterns, particularly slab allocator metrics for disk_struct or device references. Tools like /proc/slabinfo can reveal unexpected growth in disk-related allocations. Correlate memory growth with I/O throttling activity and cgroup lookup operations using kernel tracing tools (trace-cmd, perf). Log analysis of workloads that manipulate cgroups or trigger blkg operations may indicate potential triggering scenarios. A patched kernel validation script should confirm the presence of put_disk() in the blkcg error path.

Why prioritize this

Despite a CVSS score of 5.5 (Medium), this vulnerability should not be deprioritized. Its local-only requirement and lack of public exploit activity might suggest lower urgency, but the resource leak nature makes it a slow-burn stability risk. Production systems with long uptimes and active I/O cgroup management should prioritize patching to avoid cumulative memory exhaustion. The fix is typically low-risk and small, making it a good candidate for expedited patching cycles even if not immediately critical.

Risk score, explained

The CVSS 3.1 score of 5.5 reflects the local attack vector (AV:L), low complexity (AC:L), requirement for local privileges (PR:L), and high availability impact (A:H) with no confidentiality or integrity impact. This scoring correctly identifies the vulnerability as a local denial-of-service vector. However, the practical impact may be underestimated for systems with heavy I/O workloads, where memory exhaustion could occur more rapidly than the scoring suggests.

Frequently asked questions