A race exists when a task is migrated out of a cgroup; during iteration over the old task list the iterator can be advanced incorrectly, causing tasks to be omitted from listings or, when iterators advance into migrated tasks, leading to crashes or infinite loops. The flaw could disturb service accounting or confidentiality of task visibility, and in extreme cases could allow an attacker to trigger a kernel panic or denial of service on a host that relies on accurate cgroup data.

The vulnerability affects Linux kernel code that manages cgroup task lists. No specific vendor or version values were supplied, so any kernel build that includes the referenced cgroup code is potentially impacted.

The exploitation vector is not explicitly documented and would require manipulating the cgroup.procs interface while inducing a race, e.g., by injecting delays into cgroup queries. The CVSS score of 5.5 indicates medium severity. The EPSS score is not available and the vulnerability is not listed in CISA’s KEV catalog, indicating a low to moderate threat level. The race window is very small and cgroup iteration is not a hot path, so practical exploitation is unlikely under normal operating conditions.