CVE-2026-64326: block: skip sync_blockdev() on surprise removal in bdev_mark_dead()

From: Greg Kroah-Hartman <[email protected]>

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

block: skip sync_blockdev() on surprise removal in bdev_mark_dead()

bdev_mark_dead()'s @surprise == true means the device is already gone.
The filesystem callback fs_bdev_mark_dead() honours this and skips
sync_filesystem(), but the bare block device path (no ->mark_dead op)
lost its !surprise guard when the holder ->mark_dead callback was wired
up (see Fixes), and now calls sync_blockdev() unconditionally, which can
hang forever waiting on writeback that can no longer complete.

syzkaller hit this via nvme_reset_work()'s "I/O queues lost" path:
nvme_mark_namespaces_dead() -> blk_mark_disk_dead() ->
bdev_mark_dead(bdev, true) -> sync_blockdev() blocks in
folio_wait_writeback(), wedging the reset worker and every task waiting
on it.

Skip the sync on surprise removal, matching fs_bdev_mark_dead();
invalidate_bdev() still runs. Orderly removal (surprise == false) is
unchanged.

Found by FuzzNvme(Syzkaller with FEMU fuzzing framework).

The Linux kernel CVE team has assigned CVE-2026-64326 to this issue.


Affected and fixed versions
===========================

	Issue introduced in 6.6 with commit d8530de5a6e82be0ce17a5fdf727a394bcf6444c and fixed in 6.6.145 with commit d6998ddd507c81e3829489a6ead23f17f5acb7fe
	Issue introduced in 6.6 with commit d8530de5a6e82be0ce17a5fdf727a394bcf6444c and fixed in 6.12.96 with commit f41cf35ee2a1e31374b3f54e7579c55153506e70
	Issue introduced in 6.6 with commit d8530de5a6e82be0ce17a5fdf727a394bcf6444c and fixed in 6.18.39 with commit 9818bcae3c0ca1dde4b9a334125c46676e0a9b29
	Issue introduced in 6.6 with commit d8530de5a6e82be0ce17a5fdf727a394bcf6444c and fixed in 7.1.4 with commit aa4c4a9315764b2b7a7182e72cc5ea87520436b4
	Issue introduced in 6.6 with commit d8530de5a6e82be0ce17a5fdf727a394bcf6444c and fixed in 7.2-rc1 with commit 49f06cff50a4ccf3b7a1a662ceb892b3b21a527a

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2026-64326
will be updated if fixes are backported, please check that for the most
up to date information about this issue.


Affected files
==============

The file(s) affected by this issue are:
	block/bdev.c


Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/d6998ddd507c81e3829489a6ead23f17f5acb7fe
	https://git.kernel.org/stable/c/f41cf35ee2a1e31374b3f54e7579c55153506e70
	https://git.kernel.org/stable/c/9818bcae3c0ca1dde4b9a334125c46676e0a9b29
	https://git.kernel.org/stable/c/aa4c4a9315764b2b7a7182e72cc5ea87520436b4
	https://git.kernel.org/stable/c/49f06cff50a4ccf3b7a1a662ceb892b3b21a527a