CVE-2026-46223

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

cgroup: Defer css percpu_ref kill on rmdir until cgroup is depopulated

A chain of commits going back to v7.0 reworked rmdir to satisfy the

controller invariant that a subsystem's ->css_offline() must not run while

tasks are still doing kernel-side work in the cgroup.

[1] d245698d727a ("cgroup: Defer task cgroup unlink until after the task is done switching out")

[2] a72f73c4dd9b ("cgroup: Don't expose dead tasks in cgroup")

[3] 1b164b876c36 ("cgroup: Wait for dying tasks to leave on rmdir")

[4] 4c56a8ac6869 ("cgroup: Fix cgroup_drain_dying() testing the wrong condition")

[5] 13e786b64bd3 ("cgroup: Increment nr_dying_subsys_* from rmdir context")

[1] moved task cset unlink from do_exit() to finish_task_switch() so a

task's cset link drops only after the task has fully stopped scheduling.

That made tasks past exit_signals() linger on cset->tasks until their final

context switch, which led to a series of problems as w

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References