CVE-2026-98972cgroup/cpuset: Don't access cpuset_cgrp_subsys.root in is_in_v2_mode()
Updated under an hour ago ()
Does this affect you?
It affects Linux. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: cgroup/cpuset: Don't access cpuset_cgrp_subsys.root in is_in_v2_mode() After seeing the patch [1] to guard is_in_v2_mode() with RCU, it makes me realize that is_in_v2_mode() may be called in a context where a new cgroup filesystem is being rebound with stale cpuset_cgrp_subsys.root pointer. Avoid this potential UaF situation by adding a new cpuset_v2_mode flag which is set when the cpuset_v2_mode mount option is used. This flag is written into only when cpuset_bind() is being called with a stable cpuset_cgrp_subsys.root value. The is_in_v2_mode() helper is modified to read the new cpuset_v2_mode flag instead of accessing cpuset_cgrp_subsys.root directly. [1] https://lore.kernel.org/lkml/20260929084124.626693-2-arighi@nvidia.com
- CVSS
- Not yet scored
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Linux
- NVD analysis
- Received
- Record last updated
- Oct 23, 2026
- First seen by InfoSec Signals
- Oct 23, 2026
Affected products
Linux Linux linux:linux (from the name) | from b8d1b8ee93df8ffbabbeadd65d39853cfad6d698 before 988bf67a13890a37a33201f95947095ca9bec856; from b8d1b8ee93df8ffbabbeadd65d39853cfad6d698 before e06b678e3b4e12fdaa0b51a7a5a54abc5dbd6469 | CNA record |
References
- https://git.kernel.org/stable/c/988bf67a13890a37a33201f95947095ca9bec856
- https://git.kernel.org/stable/c/e06b678e3b4e12fdaa0b51a7a5a54abc5dbd6469
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.