CVE-2026-43439

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

cgroup: fix race between task migration and iteration

When a task is migrated out of a css_set, cgroup_migrate_add_task()

first moves it from cset->tasks to cset->mg_tasks via:

list_move_tail(&task->cg_list, &cset->mg_tasks);

If a css_task_iter currently has it->task_pos pointing to this task,

css_set_move_task() calls css_task_iter_skip() to keep the iterator

valid. However, since the task has already been moved to ->mg_tasks,

the iterator is advanced relative to the mg_tasks list instead of the

original tasks list. As a result, remaining tasks on cset->tasks, as

well as tasks queued on cset->mg_tasks, can be skipped by iteration.

Fix this by calling css_set_skip_task_iters() before unlinking

task->cg_list from cset->tasks. This advances all active iterators to

the next task on cset->tasks, so iteration continues correctly even

when a task is concurrently being migrated.

This race is hard to hit in practice

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References