Executive brief
A memory safety vulnerability exists in the Linux kernel's scheduling subsystem where destroying a pressure stall information (PSI) trigger during cgroup removal can cause a process to access freed memory. This could allow a local attacker to crash the system or potentially execute code with kernel privileges when interacting with cgroups while another process is polling PSI metrics.
Technical details
The vulnerability is a use-after-free (UAF) in the PSI trigger destruction logic within cgroup_file_release(). The root cause is a lifecycle mismatch: the PSI trigger's waitqueue is destroyed when a cgroup is removed, but a polling process may still be accessing that waitqueue through vfs_poll(). When cgroup_rmdir() calls cgroup_file_release(), it destroys the trigger and deallocates the waitqueue, causing any concurrent poll() syscall to dereference freed memory in poll_freewait(). The attack is local and does not require authentication—an unprivileged user can trigger it by removing a cgroup while simultaneously polling on it. The fix involves using kernfs_generic_poll(), which ties the waitqueue lifecycle to the kernfs file object rather than the trigger object.
Affected products
- Linux Linux kernel Affected versions prior to fix (exact range not specified in advisory)
Timeline
- 2025-12-24: disclosed