CVE-2026-90326

A race condition in the Linux kernel's blk-cgroup subsystem can lead to a use-after-free and memory leak when switching an I/O scheduler on a block device. The race occurs between blkcg_activate_policy() and concurrent blkcg deletion: the rollback path may access already-freed policy data (pd), a...