Linux kernel PSI: rtpoll timer can outlive its cgroup and fire on freed memory

Impact

psi_schedule_rtpoll_work() runs locklessly from the scheduler hotpath and can re-arm rtpoll_timer just as psi_trigger_destroy() tears down the last trigger. The cgroup is then freed with a pending timer, and poll_timer_fn() later runs against freed memory - a use-after-free in core scheduler accounting. Anything that reads PSI pressure triggers drives this: systemd-oomd, PSI-based autoscalers and pressure-aware schedulers all open and close triggers as cgroups come and go. On a GPU node with high pod churn the race window is hit by normal operation, and the failure mode is a kernel-side UAF rather than a clean error.

Who can reach it

Local. Requires the ability to create and destroy PSI pressure triggers on cgroups (writing to cgroup psi files) concurrently with cgroup teardown - normally the container runtime or an OOM/pressure daemon, not an untrusted tenant, though a tenant able to write its own cgroup's psi files participates.

What to do

Take the patched kernel from the linked stable commits, which bind the timer to the group lifetime and shut it down with timer_shutdown_sync() in psi_cgroup_free(). Deploy and reboot each node. Disabling PSI trigger consumers (for example systemd-oomd) narrows the exposure in the interim but does not remove the code path.

References

Related entries

• Linux kernel page_table_check: unprivileged zero mappings overflow the file map counter and panic the hostCVE-2026-74600 · Linux kernel mm/page_table_check (zero-page and huge-zero PMD accounting)Unscored
• KVM SVM SEV: races between encryption-context move and copy corrupt the mirror list and misdirect a VM referenceCVE-2026-74607 · KVM SVM SEV (owner/mirror VM list serialisation across MOVE_ENC_CONTEXT_FROM and COPY_ENC_CONTEXT_FROM)Unscored
• Linux kernel perf/core: use-after-free on a freed group leader after a sibling is detached during CPU hotplugCVE-2026-74637 · Linux kernel perf/core (perf_group_detach sibling promotion)Unscored
• Linux kernel IMA: integer underflow in xattr_verify() causes out-of-bounds read on truncated security.imaCVE-2026-74671 · Linux kernel IMA (xattr_verify digest-length check)Unscored
• Linux kernel mm/vmalloc: use-after-free when vmap huge-page promotion frees a page table under a concurrent ptdump walkCVE-2026-74672 · Linux kernel mm/vmalloc (huge vmap promotion vs ptdump page-table walk)Unscored
• Linux kernel mm: page-table reclaim flushes the wrong address, allowing reuse of a still-cached page tableCVE-2026-74674 · Linux kernel mm (zap_pte_range TLB flush address on direct page-table reclaim)Unscored