Description
In the Linux kernel, the following vulnerability has been resolved:

cgroup: Avoid iteration of dying tasks with zero refcount

The commit 260fbcb92bbea ("cgroup: Move dying_tasks cleanup from
cgroup_task_release() to cgroup_task_free()") extended the lifetime of
tasks on the dying_tasks list.
The iterators have provision to go through dying_tasks because of
dying threadgroup leaders or explicit CSS_TASK_ITER_WITH_DEAD, however,
it was expected that such tasks can obtain a new reference (that is
possible before cgroup_task_release()/put_task_struct_rcu_user()).
The tasks after cgroup_task_release() and before cgroup_task_free()
are subject to race when they may or may not have ->usage count > 0.

The race window is between css_task_iter_next() invocations
when css_set_lock is released and we may arrive at a new ->task_pos.
The iterator should not attempt to resurrect tasks whose ->usage count
dropped to zero. (When that happens, __put_task_struct_rcu_cb() is
already imminent and the returned task_struct would could be used
after free.)

As for the fix, we cannot simply check the signal->live count of a task
on the dying list because that won't distinguish regular zombies waiting
to be reaped from RCU remnant tasks that are going to be free'd.
Therefore add an extra check to rule out ->usage==0 tasks from any
iteration.

The repeat: loop in css_task_iter_advance() doesn't consider ->usage
count, so add a new loop to css_task_iter_next() to skip de-used tasks
on the dying_list.

Rough illustration of the possible race

R (reader of cgroup.procs) T (thread) L (group leader)
--------------------------------- -------------------------------- --------------------------------
L exits, signal->live > 0
cgroup_task_dead(L)
css_set_skip_task_iters() // skips only cset->tasks
list_add_tail(&L->cg_list, &cset->dying_tasks)
css_task_iter_next()
take css_set_lock
css_task_iter_advance()
leader && signal->live != 0
=> it->task_pos = &L->cg_list
release css_set_lock
T exits
--signal->live == 0
cgroup_task_dead(T) // css_set_lock
release_task(T)
cgroup_task_release(T)
release_task(L) // zap_leader
cgroup_task_release(L)
put_task_struct_rcu_user(L)
...RCU...
put_task_struct(L)
L->usage = 0
/* L still on dying_tasks */
...RCU...
__put_task_struct(L)
css_task_iter_next() // another iteration
take css_set_lock
it->task_pos = &L->cg_list
get_task_struct(L)
=> addition on 0
drop css_set_lock
cgroup_task_free(L)
css_set_skip_task_iters() // dying skip comes too late
free_task(L)
cgroup_procs_show()
task_pid_vnr(L)
Published: 2026-09-26
Score: 7.8 High
EPSS: < 1% Very Low
KEV: No
Impact: Use-after-free in cgroup task iteration leading to possible kernel crash or arbitrary code execution
Action: Apply patch
AI Analysis

Impact

The vulnerability stems from a race between the cgroup task iterator and the kernel’s cleanup of dying tasks with a zero reference count. The iterator may advance to a task that has already been freed, causing a use‑after‑free dereference. This can lead to kernel memory corruption, potentially allowing an attacker to crash the system or execute arbitrary code with kernel privileges. The weakness is a classic use‑after‑free flaw compounded by a race condition and a concurrent access issue that fails to skip de‑used tasks on the dying list.

Affected Systems

Based on the description and the affected‑product mapping, it is inferred that all Linux kernel builds that implement the old cgroup iterator logic before the fix are vulnerable. The exact kernel release number is not specified, but any distribution shipping an unpatched kernel containing the pre‑commit code is at risk. The defect is present in the generic Linux:Linux product and affects all Linux distributions relying on that kernel source.

Risk and Exploitability

The risk of exploitation is moderate due to the CVSS score of 7.8. The EPSS score is < 1%, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is reading or enumerating /proc/cgroup while a task exits, which can trigger the race. Based on the description, it is inferred that exploitation requires local or privileged access to manipulate task creation and termination, but it could potentially be abused by privileged processes.

Generated by OpenCVE AI on October 7, 2026 at 08:32 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Update the Linux kernel to a version that includes the commit that adds a check for zero usage tasks on the dying list.
  • If a patch cannot be applied immediately, restrict access to /proc/cgroup or other cgroup interfaces by configuring file permissions or using a security module such as SELinux or AppArmor to prevent unprivileged users from iterating over cgroup tasks.
  • In environments using container runtimes, consider disabling the cgroup.procs iterator feature or applying additional kernel hardening such as SMACK to limit exposure to this race.

Generated by OpenCVE AI on October 7, 2026 at 08:32 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 07 Oct 2026 07:00:00 +0000

Type Values Removed Values Added
Metrics cvssV3_1

{'score': 7.0, 'vector': 'CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H'}

 cvssV3_1

{'score': 7.8, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'}

Fri, 02 Oct 2026 21:15:00 +0000

Type Values Removed Values Added
Weaknesses CWE-362
CWE-416
CPEs cpe:2.3:o:linux:linux_kernel:7.3:rc1:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:7.3:rc2:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:7.3:rc3:*:*:*:*:*:*
Metrics cvssV3_1

{'score': 5.5, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'}

 cvssV3_1

{'score': 7.0, 'vector': 'CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H'}

Mon, 28 Sep 2026 14:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-362
CWE-416

Mon, 28 Sep 2026 12:15:00 +0000

Type Values Removed Values Added
Weaknesses CWE-366
References
Metrics threat_severity

None

 cvssV3_1

{'score': 5.5, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'}

threat_severity

Moderate

Sat, 26 Sep 2026 10:00:00 +0000

Type Values Removed Values Added
Weaknesses CWE-362
CWE-416

Sat, 26 Sep 2026 08:45:00 +0000

Type Values Removed Values Added
Description In the Linux kernel, the following vulnerability has been resolved: cgroup: Avoid iteration of dying tasks with zero refcount The commit 260fbcb92bbea ("cgroup: Move dying_tasks cleanup from cgroup_task_release() to cgroup_task_free()") extended the lifetime of tasks on the dying_tasks list. The iterators have provision to go through dying_tasks because of dying threadgroup leaders or explicit CSS_TASK_ITER_WITH_DEAD, however, it was expected that such tasks can obtain a new reference (that is possible before cgroup_task_release()/put_task_struct_rcu_user()). The tasks after cgroup_task_release() and before cgroup_task_free() are subject to race when they may or may not have ->usage count > 0. The race window is between css_task_iter_next() invocations when css_set_lock is released and we may arrive at a new ->task_pos. The iterator should not attempt to resurrect tasks whose ->usage count dropped to zero. (When that happens, __put_task_struct_rcu_cb() is already imminent and the returned task_struct would could be used after free.) As for the fix, we cannot simply check the signal->live count of a task on the dying list because that won't distinguish regular zombies waiting to be reaped from RCU remnant tasks that are going to be free'd. Therefore add an extra check to rule out ->usage==0 tasks from any iteration. The repeat: loop in css_task_iter_advance() doesn't consider ->usage count, so add a new loop to css_task_iter_next() to skip de-used tasks on the dying_list. Rough illustration of the possible race R (reader of cgroup.procs) T (thread) L (group leader) --------------------------------- -------------------------------- -------------------------------- L exits, signal->live > 0 cgroup_task_dead(L) css_set_skip_task_iters() // skips only cset->tasks list_add_tail(&L->cg_list, &cset->dying_tasks) css_task_iter_next() take css_set_lock css_task_iter_advance() leader && signal->live != 0 => it->task_pos = &L->cg_list release css_set_lock T exits --signal->live == 0 cgroup_task_dead(T) // css_set_lock release_task(T) cgroup_task_release(T) release_task(L) // zap_leader cgroup_task_release(L) put_task_struct_rcu_user(L) ...RCU... put_task_struct(L) L->usage = 0 /* L still on dying_tasks */ ...RCU... __put_task_struct(L) css_task_iter_next() // another iteration take css_set_lock it->task_pos = &L->cg_list get_task_struct(L) => addition on 0 drop css_set_lock cgroup_task_free(L) css_set_skip_task_iters() // dying skip comes too late free_task(L) cgroup_procs_show() task_pid_vnr(L)
Title cgroup: Avoid iteration of dying tasks with zero refcount
First Time appeared Linux
Linux linux Kernel
CPEs cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Vendors & Products Linux
Linux linux Kernel
References

Subscriptions

Linux Linux Kernel
cve-icon MITRE

Status: PUBLISHED

Assigner: Linux

Published:

Updated: 2026-10-07T06:49:15.579Z

Reserved: 2026-09-25T10:25:14.321Z

Link: CVE-2026-98163

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Modified

Published: 2026-09-26T09:16:38.303

Modified: 2026-10-07T07:17:02.973

Link: CVE-2026-98163

cve-icon Redhat

Severity : Moderate

Publid Date: 2026-09-26T00:00:00Z

Links: CVE-2026-98163 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-10-07T08:45:14Z

Weaknesses
  • CWE-362

    Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

  • CWE-366

    Race Condition within a Thread

  • CWE-416

    Use After Free