CVE-2026-64326

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

block: skip sync_blockdev() on surprise removal in bdev_mark_dead()

bdev_mark_dead()'s @surprise == true means the device is already gone.

The filesystem callback fs_bdev_mark_dead() honours this and skips

sync_filesystem(), but the bare block device path (no ->mark_dead op)

lost its !surprise guard when the holder ->mark_dead callback was wired

up (see Fixes), and now calls sync_blockdev() unconditionally, which can

hang forever waiting on writeback that can no longer complete.

syzkaller hit this via nvme_reset_work()'s "I/O queues lost" path:

nvme_mark_namespaces_dead() -> blk_mark_disk_dead() ->

bdev_mark_dead(bdev, true) -> sync_blockdev() blocks in

folio_wait_writeback(), wedging the reset worker and every task waiting

on it.

Skip the sync on surprise removal, matching fs_bdev_mark_dead();

invalidate_bdev() still runs. Orderly removal (surprise == false) is

unchanged.

Found by FuzzNvme(Syzkaller with FEMU fuz

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References