CVE-2026-98818

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

mm/slab: do not wake up kswapd in __kfree_rcu_sheaf()

Since kfree_rcu() can be called under pi_lock (a raw spinlock in the

scheduler), kfree_rcu() itself should never allocate memory with

__GFP_KSWAPD_RECLAIM as waking up kswapd ends up acquiring pi_lock,

which leads to a deadlock.

Reproducing the issue even intentionally was not straightforward.

The set_cpus_allowed_force() path that is called under pi_lock is

exercised very rarely, and competing tasks that allocate memory will

most likely wake kswapd up.

Therefore the existence of the deadlock was verified with a modified

kernel that has a lockdep map for waking up kswapd:

======================================================

WARNING: possible circular locking dependency detected

7.2.0-rc1-slab-for-next+ #10 Not tainted

------------------------------------------------------

git/6660 is trying to acquire lock:

ffff8e524533c550 (&p->pi_lock){-.-.}-{2:

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References