Answer in brief
CVE-2026-64326 records a Unknown severity vulnerability in block: skip sync_blockdev() on surprise removal in bdev_mark_dead(). The current sources do not mark it as known exploited. The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
A CVSS score is not reported in the current record. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| Linux/Linuxgeneric | >=d8530de5a6e82be0ce17a5fdf727a394bcf6444c <d6998ddd507c81e3829489a6ead23f17f5acb7fe || >=d8530de5a6e82be0ce17a5fdf727a394bcf6444c <f41cf35ee2a1e31374b3f54e7579c55153506e70 || >=d8530de5a6e82be0ce17a5fdf727a394bcf6444c <9818bcae3c0ca1dde4b9a334125c46676e0a9b29 || >=d8530de5a6e82be0ce17a5fdf727a394bcf6444c <aa4c4a9315764b2b7a7182e72cc5ea87520436b4 || >=d8530de5a6e82be0ce17a5fdf727a394bcf6444c <49f06cff50a4ccf3b7a1a662ceb892b3b21a527a | d6998ddd507c81e3829489a6ead23f17f5acb7fe, f41cf35ee2a1e31374b3f54e7579c55153506e70, 9818bcae3c0ca1dde4b9a334125c46676e0a9b29, aa4c4a9315764b2b7a7182e72cc5ea87520436b4, 49f06cff50a4ccf3b7a1a662ceb892b3b21a527a |
| Linux/Linuxgeneric | 6.6 | Not reported |
Published upstream
Jul 25, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Aug 17, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Aug 11, 2026
In the Linux kernel, the following vulnerability has been resolved: block: skip sync_blockdev() on surprise removal in bdev_mark_dead() bdev_mark_dead()'s @surprise == true means the device is already gone. The filesystem callback fs_bdev_mark_dead() honours this and skips sync_filesystem(), but the bare block device path (no ->mark_dead op) lost its !surprise guard when the holder ->mark_dead callback was wired up (see Fixes), and now calls sync_blockdev() unconditionally, which can hang forever waiting on writeback that can no longer complete. syzkaller hit this via nvme_reset_work()'s "I/O queues lost" path: nvme_mark_namespaces_dead() -> blk_mark_disk_dead() -> bdev_mark_dead(bdev, true) -> sync_blockdev() blocks in folio_wait_writeback(), wedging the reset worker and every task waiting on it. Skip the sync on surprise removal, matching fs_bdev_mark_dead(); invalidate_bdev() still runs. Orderly removal (surprise == false) is unchanged. Found by FuzzNvme(Syzkaller with FEMU fuzzing framework).
Quoted source text, attributed separately from HOL analysis.
Answer in brief
CVE-2026-64326 records a Unknown severity vulnerability in block: skip sync_blockdev() on surprise removal in bdev_mark_dead(). The current sources do not mark it as known exploited. The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
A CVSS score is not reported in the current record. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| Linux/Linuxgeneric | >=d8530de5a6e82be0ce17a5fdf727a394bcf6444c <d6998ddd507c81e3829489a6ead23f17f5acb7fe || >=d8530de5a6e82be0ce17a5fdf727a394bcf6444c <f41cf35ee2a1e31374b3f54e7579c55153506e70 || >=d8530de5a6e82be0ce17a5fdf727a394bcf6444c <9818bcae3c0ca1dde4b9a334125c46676e0a9b29 || >=d8530de5a6e82be0ce17a5fdf727a394bcf6444c <aa4c4a9315764b2b7a7182e72cc5ea87520436b4 || >=d8530de5a6e82be0ce17a5fdf727a394bcf6444c <49f06cff50a4ccf3b7a1a662ceb892b3b21a527a | d6998ddd507c81e3829489a6ead23f17f5acb7fe, f41cf35ee2a1e31374b3f54e7579c55153506e70, 9818bcae3c0ca1dde4b9a334125c46676e0a9b29, aa4c4a9315764b2b7a7182e72cc5ea87520436b4, 49f06cff50a4ccf3b7a1a662ceb892b3b21a527a |
| Linux/Linuxgeneric | 6.6 | Not reported |
Published upstream
Jul 25, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Aug 17, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Aug 11, 2026
In the Linux kernel, the following vulnerability has been resolved: block: skip sync_blockdev() on surprise removal in bdev_mark_dead() bdev_mark_dead()'s @surprise == true means the device is already gone. The filesystem callback fs_bdev_mark_dead() honours this and skips sync_filesystem(), but the bare block device path (no ->mark_dead op) lost its !surprise guard when the holder ->mark_dead callback was wired up (see Fixes), and now calls sync_blockdev() unconditionally, which can hang forever waiting on writeback that can no longer complete. syzkaller hit this via nvme_reset_work()'s "I/O queues lost" path: nvme_mark_namespaces_dead() -> blk_mark_disk_dead() -> bdev_mark_dead(bdev, true) -> sync_blockdev() blocks in folio_wait_writeback(), wedging the reset worker and every task waiting on it. Skip the sync on surprise removal, matching fs_bdev_mark_dead(); invalidate_bdev() still runs. Orderly removal (surprise == false) is unchanged. Found by FuzzNvme(Syzkaller with FEMU fuzzing framework).
Quoted source text, attributed separately from HOL analysis.