Linux cgroup: task iterator can resurrect a zero-refcount dying task, giving a use-after-free

Impact

After the dying_tasks lifetime change, a task can sit on that list between cgroup_task_release() and cgroup_task_free() with ->usage already dropped to zero and __put_task_struct_rcu_cb() imminent. The cgroup iterator released css_set_lock between css_task_iter_next() invocations and could then take a reference on such a task, returning a task_struct that is about to be freed - a use-after-free on core kernel objects. The reader side is nothing exotic: something reading cgroup.procs while a threadgroup leader and its threads exit. That is the normal behaviour of container runtimes, cgroup-aware monitoring agents and anything walking /sys/fs/cgroup on a busy node, so on a container host running many short-lived pods this is a realistic crash-or-worse path rather than a theoretical race. The fix skips ->usage==0 tasks in a new loop in css_task_iter_next(). No CVSS score is provided.

Who can reach it

Local: a reader of cgroup.procs racing with process exit. Any container or user able to read its own cgroup's process list plus churn processes can drive the window; no special privilege is described.

What to do

Update to a stable kernel carrying the ->usage==0 skip in css_task_iter_next() (two stable commits listed) and reboot the node - this is core cgroup code with no module to reload and no runtime toggle. Batch it into your next node-reboot wave across container hosts. The record names no distro fixed version.

References

Related entries

• Linux KVM x86/mmu: write tracking checked in one address space only, reaching a kernel BUGCVE-2026-98164 · Linux kernel KVM x86/mmu (kvm_gfn_is_write_tracked across address spaces)Unscored
• Linux kernel pmbus core: probing a VRM with more than 10 phases writes past the phase arrayCVE-2026-98199 · Linux kernel PMBus core (per-page phase array bound)Unscored
• Linux kernel trusted keys: TPM2 key load bounds-checks against the wrong blob lengthCVE-2026-98221 · Linux kernel trusted keys (TPM2 tpm2_load_cmd blob bounds)Unscored
• Linux kernel encrypted keys: u16 truncation of datablob_len gives a slab out-of-bounds writeCVE-2026-98222 · Linux kernel KEYS subsystem (encrypted keys, encrypted_key_alloc)Unscored
• Linux kernel SCSI core: unvalidated MODE SENSE lengths leak stack memory to the storage deviceCVE-2026-98232 · Linux kernel SCSI core (scsi_cdl_enable MODE SENSE length validation)Unscored
• Linux kernel dma-buf: 32-bit mapped_len truncates peer-to-peer DMA mappings larger than 4 GiBCVE-2026-98242 · Linux kernel dma-buf (phys vec to scatterlist conversion, mapped_len overflow)Unscored