Executive brief
A flaw in the Linux kernel's resource management system (cgroups) can cause the operating system to stop responding. This occurs when a system administrator or automated process attempts to remove a control group while certain background tasks are still finishing. In specific scenarios, such as during system shutdown or container teardown, this can lead to a permanent deadlock that requires a hard reboot, potentially disrupting services and operations.
Technical details
A deadlock exists in the Linux kernel cgroup subsystem due to a circular dependency during cgroup removal (rmdir). The vulnerability was introduced by a series of commits intended to ensure that subsystem offlining does not occur while tasks are still active. Specifically, rmdir(2) can block in TASK_UNINTERRUPTIBLE waiting for dying tasks to leave the cgroup. If the rmdir caller is also the parent/reaper of those tasks (common in PID namespace teardowns or systemd operations), the tasks cannot be freed because the reaper is blocked, resulting in an AB-BA deadlock. The fix involves deferring the 'css percpu_ref kill' until the cgroup is fully depopulated asynchronously.
Affected products
- Linux Linux kernel v7.0 and later
Timeline
- 2026-05-01: patched: Initial patch by Tejun Heo
- 2026-05-28: disclosed: CVE published