Executive brief
A vulnerability was identified in the Linux kernel's resource monitoring system (PSI). A race condition between closing a control group (cgroup) file and writing to it could allow a local user to crash the system. This affects system stability and availability but does not directly expose sensitive data.
Technical details
A race condition exists in the Pressure Stall Information (PSI) monitor within the Linux kernel. Specifically, a lack of proper synchronization between 'pressure_write' and 'cgroup_file_release' allows the 'priv' member of 'struct kernfs_open_file' to be accessed after it has been freed or set to NULL. This occurs when a cgroup is being removed or its files are being drained while a write operation is simultaneously occurring on a pressure-related file (e.g., memory.pressure). An attacker with local access could exploit this race to trigger a use-after-free (UAF) or a NULL pointer dereference, leading to a kernel panic. The fix involves extending the 'cgroup_mutex' scope and validating the 'priv' pointer after acquiring the lock.
Affected products
- Linux Linux kernel Introduced in 0e94682b73bf
Timeline
- 2026-04-14: other: Patch authored by Edward Adam Davis
- 2026-06-24: disclosed: CVE published by kernel.org