{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-64326","assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","state":"PUBLISHED","assignerShortName":"Linux","dateReserved":"2026-07-19T15:36:31.780Z","datePublished":"2026-07-25T08:49:54.327Z","dateUpdated":"2026-08-17T04:53:28.310Z"},"containers":{"cna":{"providerMetadata":{"orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","shortName":"Linux","dateUpdated":"2026-08-17T04:53:28.310Z"},"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nblock: skip sync_blockdev() on surprise removal in bdev_mark_dead()\n\nbdev_mark_dead()'s @surprise == true means the device is already gone.\nThe filesystem callback fs_bdev_mark_dead() honours this and skips\nsync_filesystem(), but the bare block device path (no ->mark_dead op)\nlost its !surprise guard when the holder ->mark_dead callback was wired\nup (see Fixes), and now calls sync_blockdev() unconditionally, which can\nhang forever waiting on writeback that can no longer complete.\n\nsyzkaller hit this via nvme_reset_work()'s \"I/O queues lost\" path:\nnvme_mark_namespaces_dead() -> blk_mark_disk_dead() ->\nbdev_mark_dead(bdev, true) -> sync_blockdev() blocks in\nfolio_wait_writeback(), wedging the reset worker and every task waiting\non it.\n\nSkip the sync on surprise removal, matching fs_bdev_mark_dead();\ninvalidate_bdev() still runs. Orderly removal (surprise == false) is\nunchanged.\n\nFound by FuzzNvme(Syzkaller with FEMU fuzzing framework)."}],"affected":[{"product":"Linux","vendor":"Linux","defaultStatus":"unaffected","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["block/bdev.c"],"versions":[{"version":"d8530de5a6e82be0ce17a5fdf727a394bcf6444c","lessThan":"d6998ddd507c81e3829489a6ead23f17f5acb7fe","status":"affected","versionType":"git"},{"version":"d8530de5a6e82be0ce17a5fdf727a394bcf6444c","lessThan":"f41cf35ee2a1e31374b3f54e7579c55153506e70","status":"affected","versionType":"git"},{"version":"d8530de5a6e82be0ce17a5fdf727a394bcf6444c","lessThan":"9818bcae3c0ca1dde4b9a334125c46676e0a9b29","status":"affected","versionType":"git"},{"version":"d8530de5a6e82be0ce17a5fdf727a394bcf6444c","lessThan":"aa4c4a9315764b2b7a7182e72cc5ea87520436b4","status":"affected","versionType":"git"},{"version":"d8530de5a6e82be0ce17a5fdf727a394bcf6444c","lessThan":"49f06cff50a4ccf3b7a1a662ceb892b3b21a527a","status":"affected","versionType":"git"}]},{"product":"Linux","vendor":"Linux","defaultStatus":"affected","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["block/bdev.c"],"versions":[{"version":"6.6","status":"affected"},{"version":"0","lessThan":"6.6","status":"unaffected","versionType":"semver"},{"version":"6.6.145","lessThanOrEqual":"6.6.*","status":"unaffected","versionType":"semver"},{"version":"6.12.96","lessThanOrEqual":"6.12.*","status":"unaffected","versionType":"semver"},{"version":"6.18.39","lessThanOrEqual":"6.18.*","status":"unaffected","versionType":"semver"},{"version":"7.1.4","lessThanOrEqual":"7.1.*","status":"unaffected","versionType":"semver"},{"version":"7.2","lessThanOrEqual":"*","status":"unaffected","versionType":"original_commit_for_fix"}]}],"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.6","versionEndExcluding":"6.6.145"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.6","versionEndExcluding":"6.12.96"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.6","versionEndExcluding":"6.18.39"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.6","versionEndExcluding":"7.1.4"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.6","versionEndExcluding":"7.2"}]}]}],"references":[{"url":"https://git.kernel.org/stable/c/d6998ddd507c81e3829489a6ead23f17f5acb7fe"},{"url":"https://git.kernel.org/stable/c/f41cf35ee2a1e31374b3f54e7579c55153506e70"},{"url":"https://git.kernel.org/stable/c/9818bcae3c0ca1dde4b9a334125c46676e0a9b29"},{"url":"https://git.kernel.org/stable/c/aa4c4a9315764b2b7a7182e72cc5ea87520436b4"},{"url":"https://git.kernel.org/stable/c/49f06cff50a4ccf3b7a1a662ceb892b3b21a527a"}],"title":"block: skip sync_blockdev() on surprise removal in bdev_mark_dead()","x_generator":{"engine":"bippy-1.2.0"}}}}