CVE-2026-64509 PUBLISHED

rust: block: fix GenDisk cleanup paths

Assigner: Linux
Reserved: 19.07.2026 Published: 25.07.2026 Updated: 25.07.2026

In the Linux kernel, the following vulnerability has been resolved:

rust: block: fix GenDisk cleanup paths

GenDiskBuilder::build() still has fallible work after __blk_mq_alloc_disk(), but its error path only recovers the foreign queue data. That leaks the temporary gendisk and request_queue until later teardown. If the caller moved the last Arc<TagSet\<T>> into build(), the leaked queue can retain blk-mq state after the tag set is dropped.

Fix the pre-registration failure path by dropping the temporary gendisk reference with put_disk() before recovering queue_data, so disk_release() can tear down the owned queue.

Also pair GenDisk::drop() with put_disk() after del_gendisk(). Once a Rust GenDisk has been added with device_add_disk(), del_gendisk() only unregisters it; the final gendisk reference still has to be dropped to complete the release path.

Product Status

Vendor Linux
Product Linux
Versions Default: unaffected
  • affected from 3253aba3408aa4eb2e4e09365eede3e63ef7536b to d1dcaa5229a63a6b6df7e0f673fe576cf3d6e8cb (excl.)
  • affected from 3253aba3408aa4eb2e4e09365eede3e63ef7536b to e7636f26f77070a529c26d65afd217514ce85ce4 (excl.)
  • affected from 3253aba3408aa4eb2e4e09365eede3e63ef7536b to 6822a2685b4da9a87efd1fce4b042678a31ff734 (excl.)
  • affected from 3253aba3408aa4eb2e4e09365eede3e63ef7536b to 2957771379fa335103a4b539db57bb2271e12142 (excl.)
Vendor Linux
Product Linux
Versions Default: affected
  • Version 6.11 is affected
  • unaffected from 0 to 6.11 (excl.)
  • unaffected from 6.12.97 to 6.12.* (incl.)
  • unaffected from 6.18.39 to 6.18.* (incl.)
  • unaffected from 7.1.4 to 7.1.* (incl.)
  • unaffected from 7.2-rc1 to * (incl.)

References