Cloudanix VulnDB

CVE-2026-98972

None

CVSS

—

EPSS

0.2%

Published

Oct 23, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A Linux kernel bug in how resource groups are checked could let attackers corrupt memory and potentially crash or take over affected systems.

Exploitation
Local Privilege
Attacker needs
Local User
Complexity
Moderate
Impact
Privilege Gain
Component
OS kernel
Class
Use After Free
Remediation
Patch
Effort
Medium
Patch risk
Low

What it actually does

Potential use-after-free when is_in_v2_mode() dereferences a stale cpuset_cgrp_subsys.root pointer during cgroup filesystem rebinding.

Why it matters to the business

May cause kernel instability, crashes, or limited exploitation opportunities on Linux systems that use cpuset cgroups for container and workload isolation, though immediate risk remains low given recent publication and minimal observed exploitation.

How an attack unfolds

An attacker with local access triggers concurrent cgroup mount or bind operations that leave cpuset_cgrp_subsys.root stale while is_in_v2_mode() executes, resulting in a use-after-free read or write.

How to fix it

Update to a kernel containing the cpuset_v2_mode flag that replaces direct cpuset_cgrp_subsys.root access in is_in_v2_mode().

How to confirm the fix worked

Inspect kernel source for the cpuset_v2_mode flag implementation and confirm is_in_v2_mode() reads only this flag.

Typical attack path

  1. Obtain local code execution on a Linux host using cpuset v2 mode
  2. Race cgroup filesystem rebinding with calls to is_in_v2_mode()
  3. Trigger the stale root pointer dereference to achieve memory corruption

How to detect it

Examine kernel logs for oops or panic messages referencing cpuset during cgroup mount or bind operations; correlate with unusual cgroup filesystem activity.

What your security team should do

  • Apply the referenced cpuset patch during the next kernel update cycle
  • Review systems for cpuset v2 mode usage and prioritize those running containers
  • Monitor upstream kernel changelogs for backports to supported distributions

The record

In the Linux kernel, the following vulnerability has been resolved: cgroup/cpuset: Don't access cpuset_cgrp_subsys.root in is_in_v2_mode() After seeing the patch [1] to guard is_in_v2_mode() with RCU, it makes me realize that is_in_v2_mode() may be called in a context where a new cgroup filesystem is being rebound with stale cpuset_cgrp_subsys.root pointer. Avoid this potential UaF situation by adding a new cpuset_v2_mode flag which is set when the cpuset_v2_mode mount option is used. This flag is written into only when cpuset_bind() is being called with a stable cpuset_cgrp_subsys.root value. The is_in_v2_mode() helper is modified to read the new cpuset_v2_mode flag instead of accessing cpuset_cgrp_subsys.root directly. [1] https://lore.kernel.org/lkml/20260929084124.626693-2-arighi@nvidia.com

Affected packages

Ecosystem Package Introduced Fixed