Executive brief
A race condition was identified in the Linux kernel's control groups (cgroups) mechanism, which is used to manage and isolate system resources for different processes. Under specific timing conditions, migrating a process between groups while simultaneously listing the processes in that group could cause the system to skip certain entries or, in rare cases, lead to a system crash or infinite loop. This primarily impacts the reliability of system management tools and could potentially be used to cause a local denial-of-service.
Technical details
A race condition exists in `kernel/cgroup/cgroup.c` when a task is migrated out of a `css_set`. In `cgroup_migrate_add_task()`, a task is moved from `cset->tasks` to `cset->mg_tasks` before iterators are updated. If a `css_task_iter` is currently pointing to the migrating task, the iterator may be advanced relative to the wrong list, causing it to skip remaining tasks in the original set. In extreme cases, this can lead to `css_task_iter_advance()` malfunctioning on the destination set, resulting in infinite loops or kernel crashes. The fix involves calling `css_set_skip_task_iters()` before unlinking the task from its original list to ensure all active iterators are correctly advanced.
Affected products
- Linux Linux Kernel v5.2 to v6.19.9
Timeline
- 2026-02-11: other: Patch authored
- 2026-04-18: patched: Patch committed to stable tree
- 2026-05-08: advisory: CVE published
References
- https://git.kernel.org/stable/c/3b95abab7369235a37b15eaec6e1a0b443bba7c7
- https://git.kernel.org/stable/c/3dfd1328c05234e8d8fa61948b2ba82680594988
- https://git.kernel.org/stable/c/4a9654a2b46cfdaae287fb8995f536245635e467
- https://git.kernel.org/stable/c/5ee01f1a7343d6a3547b6802ca2d4cdce0edacb1
- https://git.kernel.org/stable/c/7c85debc35e6d131bd29c64f2ae78c6ede0e55c4
- https://git.kernel.org/stable/c/86ceaccfdfa16dad05addb33dc206e03589bcfd1
- https://git.kernel.org/stable/c/9cca530c7cc1b3e02cb8fa7f80060dd4b38562ce