A race exists when a task is migrated out of a cgroup; during iteration over the old task list the iterator can be advanced incorrectly, causing tasks to be omitted from listings or, when iterators advance into migrated tasks, leading to crashes or infinite loops. The flaw could disturb service accounting or confidentiality of task visibility, and in extreme cases could allow an attacker to trigger a kernel panic or denial of service on a host that relies on accurate cgroup data.

The vulnerability affects Linux kernel cgroup task management code. Specific vendor and version information were supplied: Linux kernel, with affected releases 5.2 (rc5, rc6, rc7) and 7.0 (rc1, rc2), as well as all subsequent versions.

The exploitation vector is not explicitly documented and would require manipulating the cgroup.procs interface while inducing a race, e.g., by injecting delays into cgroup queries. The CVSS score of 4.7 indicates medium severity. The EPSS score of < 1% indicates a very low exploitation probability, and the vulnerability is not listed in CISA’s KEV catalog. The race window between migration and iteration is very small and cgroup iteration is not a hot path, so practical exploitation is unlikely under normal operating conditions.