Executive brief
The Linux kernel scheduler's pressure stall information (PSI) module has a race condition in resource group cleanup that can leave a timer armed after the group is freed. This allows a timer callback to execute on already-freed memory, potentially causing kernel crashes or unpredictable system behavior affecting workload scheduling and performance monitoring.
Technical details
A use-after-free vulnerability exists in the Linux kernel's PSI (Pressure Stall Information) subsystem within the sched/psi module. The bug is a race condition between psi_schedule_rtpoll_work() executing locklessly from the scheduler hotpath and psi_trigger_destroy() removing PSI triggers. When the last rtpoll trigger is destroyed, the rtpoll_timer can be re-armed between the timer deletion and the RCU grace period completion, resulting in the timer firing after the group is freed. An attacker with local access can trigger resource group creation and destruction patterns to exploit this race, causing the freed-memory timer callback (poll_timer_fn) to execute on deallocated kernel memory. The fix binds the timer to the group's lifetime and performs synchronous timer shutdown in psi_cgroup_free() to prevent re-arming after deletion.
Affected products
- Linux Linux kernel Multiple versions prior to fix
Timeline
- 2026-08-22: disclosed