CVE-2026-93795

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

blk-cgroup: fix leaks and online flag on radix_tree_insert failure

When radix_tree_insert() fails in blkg_create(), the error path has two

issues:

1. blkg->online is set to true unconditionally, even when the blkg was

never fully inserted. Move the assignment inside the success block.

2. The error path calls blkg_put() without first calling

percpu_ref_kill(). Because the refcount is still in percpu mode,

percpu_ref_put() only does this_cpu_sub() without checking for zero,

so blkg_release() is never triggered. This permanently leaks the

blkg memory, its percpu iostat, policy data, the parent blkg

reference, and the cgroup css reference — the latter preventing the

cgroup from ever being destroyed.

Fix by replacing blkg_put() with percpu_ref_kill(), matching the pattern

used in blkg_destroy().

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References