[PATCH 6.6.y 0/2] CVE-2026-64017: backport fix series

[Artem Dinaburg <artem@trailofbits.com>]

Hi,

Please consider this backport series for CVE-2026-64017 to 6.6.y.

Apply the patches in this order:
1. blk-mq: pop cached request if it is usable (fix)
2. blk-mq: reinsert cached request to the list (correction)

Patch 1 removes a compatible request from the older cached_rq list before
preparation and QoS throttling, then initializes it after preparation. A
plug flush can therefore no longer reuse the request while submission is
in progress.

Patch 2 returns that request to the single cached_rq list with
rq_list_add() on each of the target's three preparation or merge exits,
replacing upstream's shared-exit handling.

The complete fix is already present in 6.12.y, 6.18.y and 7.2.y.

Build-tested as part of a cumulative 6.6.y series on x86_64
(allmodconfig, CONFIG_WERROR=y).

This backport is considerably more involved than usual. 
We performed runtime testing to check validity and stability,
but would still greatly apprciate another set of eyes on it.

It was runtime-tested on v6.6.158 in a QEMU/KVM guest (KASAN, lockdep,
hung-task detection) against an unpatched baseline: blktests block
group and fio on null_blk (none, mq-deadline, bfq), virtio-blk and
ext4. No new blktests failures and no kernel warnings on the patched
kernel; no small sequential write throughput drop over 5%.

An LLM assisted with preparing these backports.

Thanks,
Artem Dinaburg