---
id: CVE-2026-53126
title: 'blk-cgroup: fix disk reference leak in blkcg_maybe_throttle_current()'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  blk-cgroup: fix disk reference leak in blkcg_maybe_throttle_current()

  Add the missing put_disk() on the error path in
  blkcg_maybe_throttle_current(). When blkcg lookup…
severity: none
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= f05837ed73d0c73e950b2d9f2612febb0d3d451e <
    4048ed98860d3785645ebbd34f69566a6c7320c3
  - >-
    Linux >= f05837ed73d0c73e950b2d9f2612febb0d3d451e <
    73a5af059905d171b398c8b2381632ee499948b5
  - >-
    Linux >= f05837ed73d0c73e950b2d9f2612febb0d3d451e <
    b3e005f16cd98f815429a87aef4c61e9c140779f
  - >-
    Linux >= f05837ed73d0c73e950b2d9f2612febb0d3d451e <
    000e8454692cab9d1f1b80130e2870e355301d06
  - >-
    Linux >= f05837ed73d0c73e950b2d9f2612febb0d3d451e <
    23308af722fefed00af5f238024c11710938fba3
  - Linux 6.3
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-11-06T16:20:10.986570Z'
published: '2026-06-24'
updated: '2026-11-06'
sourceUpdated: '2026-11-06T16:24:03.003Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-53126'
references:
  - url: 'https://git.kernel.org/stable/c/4048ed98860d3785645ebbd34f69566a6c7320c3'
  - url: 'https://git.kernel.org/stable/c/73a5af059905d171b398c8b2381632ee499948b5'
  - url: 'https://git.kernel.org/stable/c/b3e005f16cd98f815429a87aef4c61e9c140779f'
  - url: 'https://git.kernel.org/stable/c/000e8454692cab9d1f1b80130e2870e355301d06'
  - url: 'https://git.kernel.org/stable/c/23308af722fefed00af5f238024c11710938fba3'
tags:
  - cve.org
epss: 0.00114
epssPercentile: 0.01485
ingestedAt: '2026-11-06T16:57:43.285Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

blk-cgroup: fix disk reference leak in blkcg_maybe_throttle_current()

Add the missing put_disk() on the error path in
blkcg_maybe_throttle_current(). When blkcg lookup, blkg lookup, or
blkg_tryget() fails, the function jumps to the out label which only
calls rcu_read_unlock() but does not release the disk reference acquired
by blkcg_schedule_throttle() via get_device(). Since current->throttle_disk
is already set to NULL before the lookup, blkcg_exit() cannot release
this reference either, causing the disk to never be freed.

Restore the reference release that was present as blk_put_queue() in the
original code but was inadvertently dropped during the conversion from
request_queue to gendisk.

## Affected

- `Linux >= f05837ed73d0c73e950b2d9f2612febb0d3d451e < 4048ed98860d3785645ebbd34f69566a6c7320c3`
- `Linux >= f05837ed73d0c73e950b2d9f2612febb0d3d451e < 73a5af059905d171b398c8b2381632ee499948b5`
- `Linux >= f05837ed73d0c73e950b2d9f2612febb0d3d451e < b3e005f16cd98f815429a87aef4c61e9c140779f`
- `Linux >= f05837ed73d0c73e950b2d9f2612febb0d3d451e < 000e8454692cab9d1f1b80130e2870e355301d06`
- `Linux >= f05837ed73d0c73e950b2d9f2612febb0d3d451e < 23308af722fefed00af5f238024c11710938fba3`
- `Linux 6.3`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.