Linux kernel sched/psi: use-after-free when a cgroup is removed under a poll() on its pressure file

Impact

Destroying a PSI trigger in cgroup_file_release frees the waitqueue head while a synchronous poll() on the cgroup's pressure file is still referencing it, so removing a cgroup out from under a poller gives a use-after-free in poll_freewait. This is directly reachable in a Kubernetes GPU fleet: pressure-stall monitors and memory-pressure-aware eviction agents poll cgroup psi files, and pods are created and torn down constantly, so cgroup removal racing a poller is routine rather than exotic. The record describes a kernel UAF; the realistic outcome on a busy node is a crash that takes all co-tenant pods with it.

Who can reach it

Local user or agent that can poll() a cgroup's pressure file while another party removes that cgroup. In practice a node agent with cgroupfs access, or a tenant that can both poll its own cgroup's psi file and cause the cgroup to be removed.

What to do

Update to a stable kernel carrying the kernfs_generic_poll conversion (commits 92cc0153324b, aff037078eca, d124ab17024c) and reboot each node. Interim mitigation: stop PSI-polling agents from poll()ing cgroup-scoped pressure files, or disable PSI (psi=0 on the kernel command line, which also requires a reboot).

References

Related entries

• Linux kernel crypto/essiv: EBUSY from a backlogged request frees live data, giving a use-after-freeCVE-2023-54046 · Linux kernel crypto essiv template (MAY_BACKLOG EBUSY handling)High
• Linux kernel bpf: preemption left enabled in bpf_event_output corrupts shared perf sample bufferCVE-2023-54173 · Linux kernel BPF (bpf_event_output preemption)High
• Linux i915 GPU kernel driver: A use-after-free in the i915 GPU kernel driver. The general shape is that a GPU object isCVE-2023-54202 · Linux i915 GPU kernel driverHigh
• Linux kernel (netfilter pipapo): Inactive elements mishandled in nft_pipapo_walk - use-after-free, local rootCVE-2023-6817 · Linux kernel (netfilter pipapo)High
• Linux kernel (io_uring): Page use-after-free via io_uring buffer-ring mmap - unprivileged local user to rootCVE-2024-0582 · Linux kernel (io_uring)High
• Linux kernel (nf_tables): Use-after-free in nft_verdict_init() - double-free to local rootCVE-2024-1086 · Linux kernel (nf_tables)High