{"id":"CVE-2026-64326","summary":"block: skip sync_blockdev() on surprise removal in bdev_mark_dead()","details":"In the Linux kernel, the following vulnerability has been resolved:\n\nblock: skip sync_blockdev() on surprise removal in bdev_mark_dead()\n\nbdev_mark_dead()'s @surprise == true means the device is already gone.\nThe filesystem callback fs_bdev_mark_dead() honours this and skips\nsync_filesystem(), but the bare block device path (no -\u003emark_dead op)\nlost its !surprise guard when the holder -\u003emark_dead callback was wired\nup (see Fixes), and now calls sync_blockdev() unconditionally, which can\nhang forever waiting on writeback that can no longer complete.\n\nsyzkaller hit this via nvme_reset_work()'s \"I/O queues lost\" path:\nnvme_mark_namespaces_dead() -\u003e blk_mark_disk_dead() -\u003e\nbdev_mark_dead(bdev, true) -\u003e sync_blockdev() blocks in\nfolio_wait_writeback(), wedging the reset worker and every task waiting\non it.\n\nSkip the sync on surprise removal, matching fs_bdev_mark_dead();\ninvalidate_bdev() still runs. Orderly removal (surprise == false) is\nunchanged.\n\nFound by FuzzNvme(Syzkaller with FEMU fuzzing framework).","modified":"2026-07-27T04:03:20.020471110Z","published":"2026-07-25T08:49:54.327Z","database_specific":{"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/64xxx/CVE-2026-64326.json","cna_assigner":"Linux"},"references":[{"type":"WEB","url":"https://git.kernel.org/stable/c/49f06cff50a4ccf3b7a1a662ceb892b3b21a527a"},{"type":"WEB","url":"https://git.kernel.org/stable/c/9818bcae3c0ca1dde4b9a334125c46676e0a9b29"},{"type":"WEB","url":"https://git.kernel.org/stable/c/aa4c4a9315764b2b7a7182e72cc5ea87520436b4"},{"type":"WEB","url":"https://git.kernel.org/stable/c/d6998ddd507c81e3829489a6ead23f17f5acb7fe"},{"type":"WEB","url":"https://git.kernel.org/stable/c/f41cf35ee2a1e31374b3f54e7579c55153506e70"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/64xxx/CVE-2026-64326.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-64326"},{"type":"PACKAGE","url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","events":[{"introduced":"d8530de5a6e82be0ce17a5fdf727a394bcf6444c"},{"fixed":"d6998ddd507c81e3829489a6ead23f17f5acb7fe"},{"fixed":"f41cf35ee2a1e31374b3f54e7579c55153506e70"},{"fixed":"9818bcae3c0ca1dde4b9a334125c46676e0a9b29"},{"fixed":"aa4c4a9315764b2b7a7182e72cc5ea87520436b4"},{"fixed":"49f06cff50a4ccf3b7a1a662ceb892b3b21a527a"}]}],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-64326.json"}},{"package":{"name":"Kernel","ecosystem":"Linux"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.6.0"},{"fixed":"6.6.145"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.7.0"},{"fixed":"6.12.96"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.13.0"},{"fixed":"6.18.39"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.19.0"},{"fixed":"7.1.4"}]}],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-64326.json"}}],"schema_version":"1.7.5"}