CVE-2026-98972
- Source
- https://cve.org/CVERecord?id=CVE-2026-98972
- Import Source
- https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-98972.json
- JSON Data
- https://api.test.osv.dev/v1/vulns/CVE-2026-98972
- Downstream
- Published
- 2026-10-23T12:19:45Z
- Modified
- 2026-10-25T02:47:29Z
- Summary
- cgroup/cpuset: Don't access cpuset_cgrp_subsys.root in is_in_v2_mode()
- Details
-
In the Linux kernel, the following vulnerability has been resolved:
cgroup/cpuset: Don't access cpuset_cgrp_subsys.root in is_in_v2_mode()
After seeing the patch [1] to guard is_in_v2_mode() with RCU, it makes me realize that is_in_v2_mode() may be called in a context where a new cgroup filesystem is being rebound with stale cpuset_cgrp_subsys.root pointer. Avoid this potential UaF situation by adding a new cpuset_v2_mode flag which is set when the cpuset_v2_mode mount option is used. This flag is written into only when cpuset_bind() is being called with a stable cpuset_cgrp_subsys.root value. The is_in_v2_mode() helper is modified to read the new cpuset_v2_mode flag instead of accessing cpuset_cgrp_subsys.root directly.
[1] https://lore.kernel.org/lkml/20260929084124.626693-2-arighi@nvidia.com
- Database specific
{ "cna_assigner": "Linux", "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/98xxx/CVE-2026-98972.json" }- References
-
- https://git.kernel.org/stable/c/988bf67a13890a37a33201f95947095ca9bec856
- https://git.kernel.org/stable/c/e06b678e3b4e12fdaa0b51a7a5a54abc5dbd6469
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/98xxx/CVE-2026-98972.json
- https://nvd.nist.gov/vuln/detail/CVE-2026-98972
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git