CVE-2026-98163

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

cgroup: Avoid iteration of dying tasks with zero refcount

The commit 260fbcb92bbea ("cgroup: Move dying_tasks cleanup from

cgroup_task_release() to cgroup_task_free()") extended the lifetime of

tasks on the dying_tasks list.

The iterators have provision to go through dying_tasks because of

dying threadgroup leaders or explicit CSS_TASK_ITER_WITH_DEAD, however,

it was expected that such tasks can obtain a new reference (that is

possible before cgroup_task_release()/put_task_struct_rcu_user()).

The tasks after cgroup_task_release() and before cgroup_task_free()

are subject to race when they may or may not have ->usage count > 0.

The race window is between css_task_iter_next() invocations

when css_set_lock is released and we may arrive at a new ->task_pos.

The iterator should not attempt to resurrect tasks whose ->usage count

dropped to zero. (When that happens, __put_task_struct_rcu_cb() is

already imminent and the re

/// Remediation

Check the references section for vendor advisories and patches from linux. Update linux_kernel to the latest patched version. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// Affected products

/// References