CVE-2026-98536 - Vulnerability Details

- writeback: report a Tasks-RCU quiescent state per cgwb drain pass

Description

In the Linux kernel, the following vulnerability has been resolved:

writeback: report a Tasks-RCU quiescent state per cgwb drain pass

cleanup_offline_cgwbs_workfn() drains a dying cgwb by calling
cleanup_offline_cgwb() until it returns false, with a cond_resched()
between passes. On a CONFIG_PREEMPTION kernel that cond_resched() does
nothing: _cond_resched() is a plain "return 0", and under PREEMPT_DYNAMIC
the full and lazy modes disable it. Since commit 7dadeaa6e851 ("sched:
Further restrict the preemption modes") those are the only two models on
the architectures with PREEMPT_LAZY support, arm64 and x86 among them, so
the drain loop never reports a Tasks-RCU quiescent state.

A worker draining a cgwb with millions of attached inodes runs for
minutes. On a 6.18 arm64 host in lazy mode the cgwb worker drained one
dying cgroup's writeback domain for over 11 minutes. A BPF program unlink
(bpf_trampoline_unlink_prog -> bpf_trampoline_update ->
unregister_ftrace_direct -> ftrace_shutdown -> synchronize_rcu_tasks())
waited on that grace period while holding the trampoline mutex, 42 tasks
queued behind it in D state, and the hung task detector fired at 614 s and
panicked the host. Any BPF or ftrace detach during a long drain inherits
the drain's length.

Fix this by calling cond_resched_tasks_rcu_qs() so we do not stall out
anybody who calls sycnrhonize_rcu_tasks(). We put this in a do { } while
loop because if we have many small cgroups cleanup_offline_cgwb() will
return false and we will never call cond_resched_tasks_rcu_qs(), creating
the same problem.

Published: 2026-10-18

Score: 4.7 Medium

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

The flaw is in the writeback subsystem of the Linux kernel, where draining a writeback domain never reports an RCU quiescent state. A long‑running drain holding the trampoline mutex can indefinitely block calls to synchronize_rcu_tasks(), ultimately triggering the hung task detector and causing a kernel crash. The bug is present in CONFIG_PREEMPTION kernels using PREEMPT_LAZY on architectures such as arm64 and x86, and is classified with a CVSS score of 4.7, reflecting moderate severity but a potentially catastrophic impact on availability.

Affected Systems

Linux kernel builds that enable CONFIG_PREEMPTION with PREEMPT_LAZY on arm64 or x86 are affected when the kernel includes the commit that restricts preemption modes. The issue was observed in kernel 6.18 arm64 during a prolonged writeback drain, and any kernel lacking the patch will remain vulnerable.

Risk and Exploitability

The EPSS score of < 1% indicates a very low likelihood of exploitation, but the vulnerability can be triggered by a local user process that initiates a long writeback drain and performs a BPF unlink or ftrace detach while the drain is in progress, as shown by the description. Aided by the fact that the flaw leads to a kernel crash, the risk to system availability is high. The vulnerability is not listed in CISA’s KEV catalog, but the defensive posture should treat it as a significant threat.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`c22d70a162d3cc177282c4487be4d54876ca55c8`	affected	< 863049b4018237d1590cd13b16e9fe9c0faad2c6
`c22d70a162d3cc177282c4487be4d54876ca55c8`	affected	< 42462b5bb0dec57db7f85d0f77655c737d45754d
`c22d70a162d3cc177282c4487be4d54876ca55c8`	affected	< ebf1555ad2821be06f87a88ffd9a2cab8d2200e1
`c22d70a162d3cc177282c4487be4d54876ca55c8`	affected	< 4eb889649eaf65f4a5727b04ba1c017b7d05bb16
`c22d70a162d3cc177282c4487be4d54876ca55c8`	affected	< fd3bf32279df98751364b3609eb100a3e42f253b
`c22d70a162d3cc177282c4487be4d54876ca55c8`	affected	< 260f586a80e7f624dd7f069898a75a904f34d373
`c22d70a162d3cc177282c4487be4d54876ca55c8`	affected	< 407a5d205179a4ab186571b0e16ec42725dc77bc

Linux

affected

Version	Status	Constraints
`5.14`	affected	—
`0`	unaffected	< 5.14
`5.15.222`	unaffected	≤ 5.15.*
`6.1.189`	unaffected	≤ 6.1.*
`6.6.158`	unaffected	≤ 6.6.*
`6.12.112`	unaffected	≤ 6.12.*
`6.18.55`	unaffected	≤ 6.18.*
`7.2.9`	unaffected	≤ 7.2.*
`7.3`	unaffected	≤ *

No data.

Vendor Product Confidence Versions

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[c22d70a162d3cc177282c4487be4d54876ca55c8,863049b4018237d1590cd13b16e9fe9c0faad2c6)`	affected	code_commit	—
`[c22d70a162d3cc177282c4487be4d54876ca55c8,42462b5bb0dec57db7f85d0f77655c737d45754d)`	affected	code_commit	—
`[c22d70a162d3cc177282c4487be4d54876ca55c8,ebf1555ad2821be06f87a88ffd9a2cab8d2200e1)`	affected	code_commit	—
`[c22d70a162d3cc177282c4487be4d54876ca55c8,4eb889649eaf65f4a5727b04ba1c017b7d05bb16)`	affected	code_commit	—
`[c22d70a162d3cc177282c4487be4d54876ca55c8,fd3bf32279df98751364b3609eb100a3e42f253b)`	affected	code_commit	—
`[c22d70a162d3cc177282c4487be4d54876ca55c8,260f586a80e7f624dd7f069898a75a904f34d373)`	affected	code_commit	—
`[c22d70a162d3cc177282c4487be4d54876ca55c8,407a5d205179a4ab186571b0e16ec42725dc77bc)`	affected	code_commit	—

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`5.14`	affected	generic	—
`[0,5.14)`	unaffected	generic	—
`[5.15.222,5.16.0)`	unaffected	semver	—
`[6.1.189,6.2.0)`	unaffected	semver	—
`[6.6.158,6.7.0)`	unaffected	semver	—
`[6.12.112,6.13.0)`	unaffected	semver	—
`[6.18.55,6.19.0)`	unaffected	semver	—
`[7.2.9,7.3.0)`	unaffected	semver	—
`[7.3-rc5,*]`	unaffected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Apply the kernel patch that routes the drain loop through cond_resched_tasks_rcu_qs, which fixes the issue.
If the patch is not available, avoid detaching BPF programs or ftrace deinitialization while a writeback drain is in progress.
Consider disabling PREEMPT_LAZY or enabling full preemption mode so that cond_resched() can reschedule workers, reducing the chance of a blocking drain.
Monitor kernel logs for hung task detector or RCU sync hang messages and reboot if a crash occurs.

Generated by OpenCVE AI on October 20, 2026 at 16:18 UTC.

Tracking

Sign in to view the affected projects.

Advisories

Source	ID	Title
Debian DLA	DLA-4850-1	linux-6.12 security update
Ubuntu USN	USN-8961-1	Linux kernel vulnerabilities

No CVSS v4.0

Attack Vector Local

Attack Complexity High

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00215.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-98536.mbox
https://git.kernel.org/stable/c/260f586a80e7f624dd7f069898a75a904f34d373
https://git.kernel.org/stable/c/407a5d205179a4ab186571b0e16ec42725dc77bc
https://git.kernel.org/stable/c/42462b5bb0dec57db7f85d0f77655c737d45754d
https://git.kernel.org/stable/c/4eb889649eaf65f4a5727b04ba1c017b7d05bb16
https://git.kernel.org/stable/c/863049b4018237d1590cd13b16e9fe9c0faad2c6
https://git.kernel.org/stable/c/ebf1555ad2821be06f87a88ffd9a2cab8d2200e1
https://git.kernel.org/stable/c/fd3bf32279df98751364b3609eb100a3e42f253b
https://nvd.nist.gov/vuln/detail/CVE-2026-98536
https://www.cve.org/CVERecord?id=CVE-2026-98536

History

Tue, 20 Oct 2026 13:45:00 +0000

Type	Values Removed	Values Added
Weaknesses	CWE-106

Tue, 20 Oct 2026 00:30:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-821
References		https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-98536.mbox https://nvd.nist.gov/vuln/detail/CVE-2026-98536 https://www.cve.org/CVERecord?id=CVE-2026-98536
Metrics	threat_severity `None`	cvssV3_1 `{'score': 4.7, 'vector': 'CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H'}` threat_severity `Moderate`

Sun, 18 Oct 2026 23:45:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-106

Sun, 18 Oct 2026 15:30:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: writeback: report a Tasks-RCU quiescent state per cgwb drain pass cleanup_offline_cgwbs_workfn() drains a dying cgwb by calling cleanup_offline_cgwb() until it returns false, with a cond_resched() between passes. On a CONFIG_PREEMPTION kernel that cond_resched() does nothing: _cond_resched() is a plain "return 0", and under PREEMPT_DYNAMIC the full and lazy modes disable it. Since commit 7dadeaa6e851 ("sched: Further restrict the preemption modes") those are the only two models on the architectures with PREEMPT_LAZY support, arm64 and x86 among them, so the drain loop never reports a Tasks-RCU quiescent state. A worker draining a cgwb with millions of attached inodes runs for minutes. On a 6.18 arm64 host in lazy mode the cgwb worker drained one dying cgroup's writeback domain for over 11 minutes. A BPF program unlink (bpf_trampoline_unlink_prog -> bpf_trampoline_update -> unregister_ftrace_direct -> ftrace_shutdown -> synchronize_rcu_tasks()) waited on that grace period while holding the trampoline mutex, 42 tasks queued behind it in D state, and the hung task detector fired at 614 s and panicked the host. Any BPF or ftrace detach during a long drain inherits the drain's length. Fix this by calling cond_resched_tasks_rcu_qs() so we do not stall out anybody who calls sycnrhonize_rcu_tasks(). We put this in a do { } while loop because if we have many small cgroups cleanup_offline_cgwb() will return false and we will never call cond_resched_tasks_rcu_qs(), creating the same problem.
Title		writeback: report a Tasks-RCU quiescent state per cgwb drain pass
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/260f586a80e7f624dd7f069898a75a904f34d373 https://git.kernel.org/stable/c/407a5d205179a4ab186571b0e16ec42725dc77bc https://git.kernel.org/stable/c/42462b5bb0dec57db7f85d0f77655c737d45754d https://git.kernel.org/stable/c/4eb889649eaf65f4a5727b04ba1c017b7d05bb16 https://git.kernel.org/stable/c/863049b4018237d1590cd13b16e9fe9c0faad2c6 https://git.kernel.org/stable/c/ebf1555ad2821be06f87a88ffd9a2cab8d2200e1 https://git.kernel.org/stable/c/fd3bf32279df98751364b3609eb100a3e42f253b

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-10-18T15:18:04.013Z

Updated: 2026-10-19T09:21:19.730Z

Reserved: 2026-09-25T10:25:14.355Z

Link: CVE-2026-98536

Vulnrichment

No data.

NVD

Status : Received

Published: 2026-10-18T16:17:05.357

Modified: 2026-10-19T10:19:09.220

Link: CVE-2026-98536

Redhat

Severity : Moderate

Publid Date: 2026-10-18T00:00:00Z

Links: CVE-2026-98536 - Bugzilla

OpenCVE Enrichment

Updated: 2026-10-20T16:30:06Z

Weaknesses

CWE-821
Incorrect Synchronization

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Local

Attack Complexity High

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object