CVE-2026-53126

Source
https://cve.org/CVERecord?id=CVE-2026-53126
Import Source
https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-53126.json
JSON Data
https://api.test.osv.dev/v1/vulns/CVE-2026-53126
Downstream
Published
2026-06-24T16:30:54.594Z
Modified
2026-06-25T04:05:21.128826286Z
Summary
blk-cgroup: fix disk reference leak in blkcg_maybe_throttle_current()
Details

In the Linux kernel, the following vulnerability has been resolved:

blk-cgroup: fix disk reference leak in blkcgmaybethrottle_current()

Add the missing putdisk() on the error path in blkcgmaybethrottlecurrent(). When blkcg lookup, blkg lookup, or blkgtryget() fails, the function jumps to the out label which only calls rcureadunlock() but does not release the disk reference acquired by blkcgschedulethrottle() via getdevice(). Since current->throttledisk is already set to NULL before the lookup, blkcgexit() cannot release this reference either, causing the disk to never be freed.

Restore the reference release that was present as blkputqueue() in the original code but was inadvertently dropped during the conversion from request_queue to gendisk.

Database specific
{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/53xxx/CVE-2026-53126.json",
    "cna_assigner": "Linux"
}
References

Affected packages

Git / git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git

Affected ranges

Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
f05837ed73d0c73e950b2d9f2612febb0d3d451e
Fixed
4048ed98860d3785645ebbd34f69566a6c7320c3
Fixed
73a5af059905d171b398c8b2381632ee499948b5
Fixed
b3e005f16cd98f815429a87aef4c61e9c140779f
Fixed
000e8454692cab9d1f1b80130e2870e355301d06
Fixed
23308af722fefed00af5f238024c11710938fba3

Database specific

source
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-53126.json"

Linux / Kernel

Package

Name
Kernel

Affected ranges

Type
ECOSYSTEM
Events
Introduced
6.3.0
Fixed
6.6.141
Type
ECOSYSTEM
Events
Introduced
6.7.0
Fixed
6.12.91
Type
ECOSYSTEM
Events
Introduced
6.13.0
Fixed
6.18.33
Type
ECOSYSTEM
Events
Introduced
6.19.0
Fixed
7.0.10

Database specific

source
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-53126.json"