CVE-2026-64326 (GCVE-0-2026-64326)
Vulnerability from cvelistv5 – Published: 2026-07-25 08:49 – Updated: 2026-07-25 08:49
VLAI
EPSS
VEX
Title
block: skip sync_blockdev() on surprise removal in bdev_mark_dead()
Summary
In the Linux kernel, the following vulnerability has been resolved:
block: skip sync_blockdev() on surprise removal in bdev_mark_dead()
bdev_mark_dead()'s @surprise == true means the device is already gone.
The filesystem callback fs_bdev_mark_dead() honours this and skips
sync_filesystem(), but the bare block device path (no ->mark_dead op)
lost its !surprise guard when the holder ->mark_dead callback was wired
up (see Fixes), and now calls sync_blockdev() unconditionally, which can
hang forever waiting on writeback that can no longer complete.
syzkaller hit this via nvme_reset_work()'s "I/O queues lost" path:
nvme_mark_namespaces_dead() -> blk_mark_disk_dead() ->
bdev_mark_dead(bdev, true) -> sync_blockdev() blocks in
folio_wait_writeback(), wedging the reset worker and every task waiting
on it.
Skip the sync on surprise removal, matching fs_bdev_mark_dead();
invalidate_bdev() still runs. Orderly removal (surprise == false) is
unchanged.
Found by FuzzNvme(Syzkaller with FEMU fuzzing framework).
Severity
No CVSS data available.
Assigner
References
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
d8530de5a6e82be0ce17a5fdf727a394bcf6444c , < d6998ddd507c81e3829489a6ead23f17f5acb7fe
(git)
Affected: d8530de5a6e82be0ce17a5fdf727a394bcf6444c , < f41cf35ee2a1e31374b3f54e7579c55153506e70 (git) Affected: d8530de5a6e82be0ce17a5fdf727a394bcf6444c , < 9818bcae3c0ca1dde4b9a334125c46676e0a9b29 (git) Affected: d8530de5a6e82be0ce17a5fdf727a394bcf6444c , < aa4c4a9315764b2b7a7182e72cc5ea87520436b4 (git) Affected: d8530de5a6e82be0ce17a5fdf727a394bcf6444c , < 49f06cff50a4ccf3b7a1a662ceb892b3b21a527a (git) |
|
| Linux | Linux |
Affected:
6.6
Unaffected: 0 , < 6.6 (semver) Unaffected: 6.6.145 , ≤ 6.6.* (semver) Unaffected: 6.12.96 , ≤ 6.12.* (semver) Unaffected: 6.18.39 , ≤ 6.18.* (semver) Unaffected: 7.1.4 , ≤ 7.1.* (semver) Unaffected: 7.2-rc1 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"block/bdev.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "d6998ddd507c81e3829489a6ead23f17f5acb7fe",
"status": "affected",
"version": "d8530de5a6e82be0ce17a5fdf727a394bcf6444c",
"versionType": "git"
},
{
"lessThan": "f41cf35ee2a1e31374b3f54e7579c55153506e70",
"status": "affected",
"version": "d8530de5a6e82be0ce17a5fdf727a394bcf6444c",
"versionType": "git"
},
{
"lessThan": "9818bcae3c0ca1dde4b9a334125c46676e0a9b29",
"status": "affected",
"version": "d8530de5a6e82be0ce17a5fdf727a394bcf6444c",
"versionType": "git"
},
{
"lessThan": "aa4c4a9315764b2b7a7182e72cc5ea87520436b4",
"status": "affected",
"version": "d8530de5a6e82be0ce17a5fdf727a394bcf6444c",
"versionType": "git"
},
{
"lessThan": "49f06cff50a4ccf3b7a1a662ceb892b3b21a527a",
"status": "affected",
"version": "d8530de5a6e82be0ce17a5fdf727a394bcf6444c",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"block/bdev.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.6"
},
{
"lessThan": "6.6",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.145",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.96",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.39",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.4",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2-rc1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.145",
"versionStartIncluding": "6.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.96",
"versionStartIncluding": "6.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.39",
"versionStartIncluding": "6.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.4",
"versionStartIncluding": "6.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2-rc1",
"versionStartIncluding": "6.6",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nblock: skip sync_blockdev() on surprise removal in bdev_mark_dead()\n\nbdev_mark_dead()\u0027s @surprise == true means the device is already gone.\nThe filesystem callback fs_bdev_mark_dead() honours this and skips\nsync_filesystem(), but the bare block device path (no -\u003emark_dead op)\nlost its !surprise guard when the holder -\u003emark_dead callback was wired\nup (see Fixes), and now calls sync_blockdev() unconditionally, which can\nhang forever waiting on writeback that can no longer complete.\n\nsyzkaller hit this via nvme_reset_work()\u0027s \"I/O queues lost\" path:\nnvme_mark_namespaces_dead() -\u003e blk_mark_disk_dead() -\u003e\nbdev_mark_dead(bdev, true) -\u003e sync_blockdev() blocks in\nfolio_wait_writeback(), wedging the reset worker and every task waiting\non it.\n\nSkip the sync on surprise removal, matching fs_bdev_mark_dead();\ninvalidate_bdev() still runs. Orderly removal (surprise == false) is\nunchanged.\n\nFound by FuzzNvme(Syzkaller with FEMU fuzzing framework)."
}
],
"providerMetadata": {
"dateUpdated": "2026-07-25T08:49:54.327Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/d6998ddd507c81e3829489a6ead23f17f5acb7fe"
},
{
"url": "https://git.kernel.org/stable/c/f41cf35ee2a1e31374b3f54e7579c55153506e70"
},
{
"url": "https://git.kernel.org/stable/c/9818bcae3c0ca1dde4b9a334125c46676e0a9b29"
},
{
"url": "https://git.kernel.org/stable/c/aa4c4a9315764b2b7a7182e72cc5ea87520436b4"
},
{
"url": "https://git.kernel.org/stable/c/49f06cff50a4ccf3b7a1a662ceb892b3b21a527a"
}
],
"title": "block: skip sync_blockdev() on surprise removal in bdev_mark_dead()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-64326",
"datePublished": "2026-07-25T08:49:54.327Z",
"dateReserved": "2026-07-19T15:36:31.780Z",
"dateUpdated": "2026-07-25T08:49:54.327Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"vulnerability-lookup:meta": {
"epss": {
"cve": "CVE-2026-64326",
"date": "2026-07-26",
"epss": "0.002",
"percentile": "0.10113"
},
"microsoft_vex": {
"current_release_date": "2026-07-26T01:06:11.000Z",
"cve": "CVE-2026-64326",
"id": "msrc_CVE-2026-64326",
"initial_release_date": "2026-07-26T01:06:11.000Z",
"product_status:under_investigation": "1",
"source": "Microsoft CSAF VEX",
"status": "final",
"title": "block: skip sync_blockdev() on surprise removal in bdev_mark_dead()",
"url": "https://msrc.microsoft.com/csaf/vex/2026/msrc_cve-2026-64326.json",
"version": "1"
},
"nvd": "{\"cve\":{\"id\":\"CVE-2026-64326\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2026-07-25T10:17:14.207\",\"lastModified\":\"2026-07-25T10:17:14.207\",\"vulnStatus\":\"Received\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nblock: skip sync_blockdev() on surprise removal in bdev_mark_dead()\\n\\nbdev_mark_dead()\u0027s @surprise == true means the device is already gone.\\nThe filesystem callback fs_bdev_mark_dead() honours this and skips\\nsync_filesystem(), but the bare block device path (no -\u003emark_dead op)\\nlost its !surprise guard when the holder -\u003emark_dead callback was wired\\nup (see Fixes), and now calls sync_blockdev() unconditionally, which can\\nhang forever waiting on writeback that can no longer complete.\\n\\nsyzkaller hit this via nvme_reset_work()\u0027s \\\"I/O queues lost\\\" path:\\nnvme_mark_namespaces_dead() -\u003e blk_mark_disk_dead() -\u003e\\nbdev_mark_dead(bdev, true) -\u003e sync_blockdev() blocks in\\nfolio_wait_writeback(), wedging the reset worker and every task waiting\\non it.\\n\\nSkip the sync on surprise removal, matching fs_bdev_mark_dead();\\ninvalidate_bdev() still runs. Orderly removal (surprise == false) is\\nunchanged.\\n\\nFound by FuzzNvme(Syzkaller with FEMU fuzzing framework).\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"block/bdev.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"d8530de5a6e82be0ce17a5fdf727a394bcf6444c\",\"lessThan\":\"d6998ddd507c81e3829489a6ead23f17f5acb7fe\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"d8530de5a6e82be0ce17a5fdf727a394bcf6444c\",\"lessThan\":\"f41cf35ee2a1e31374b3f54e7579c55153506e70\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"d8530de5a6e82be0ce17a5fdf727a394bcf6444c\",\"lessThan\":\"9818bcae3c0ca1dde4b9a334125c46676e0a9b29\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"d8530de5a6e82be0ce17a5fdf727a394bcf6444c\",\"lessThan\":\"aa4c4a9315764b2b7a7182e72cc5ea87520436b4\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"d8530de5a6e82be0ce17a5fdf727a394bcf6444c\",\"lessThan\":\"49f06cff50a4ccf3b7a1a662ceb892b3b21a527a\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"block/bdev.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"6.6\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"6.6\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.6.145\",\"lessThanOrEqual\":\"6.6.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.12.96\",\"lessThanOrEqual\":\"6.12.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.18.39\",\"lessThanOrEqual\":\"6.18.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.1.4\",\"lessThanOrEqual\":\"7.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.2-rc1\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/49f06cff50a4ccf3b7a1a662ceb892b3b21a527a\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/9818bcae3c0ca1dde4b9a334125c46676e0a9b29\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/aa4c4a9315764b2b7a7182e72cc5ea87520436b4\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/d6998ddd507c81e3829489a6ead23f17f5acb7fe\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/f41cf35ee2a1e31374b3f54e7579c55153506e70\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}",
"suse_vex": {
"aggregate_severity": "not set",
"current_release_date": "2026-07-25T16:45:39Z",
"cve": "CVE-2026-64326",
"id": "CVE-2026-64326",
"initial_release_date": "2026-07-25T16:45:39Z",
"source": "SUSE CSAF VEX",
"status": "interim",
"title": "SUSE CVE CVE-2026-64326",
"url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-64326.json",
"version": "2"
}
}
}
Loading…
Loading…
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the
vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base
model, served locally by ML-Gateway.
They have not been verified by an analyst and are provided for guidance only.
Loading…
Loading…