Linux Kernel Vulnerability in cgroup Affecting Task Lifecycle Management

CVE-2026-98163

What is CVE-2026-98163?

A race condition was identified in the Linux kernel's cgroup subsystem, affecting the management of tasks in the dying_tasks list. This flaw arises during iterations that may resurrect tasks with a zero usage count, potentially leading to use-after-free scenarios. The vulnerability stems from the mismanagement of task references after the cgroup_task_release() function is invoked. Specifically, tasks that transition to dying state while maintaining an unexpected reference count can still be inadvertently accessed, posing a risk to system stability. The fix introduces additional checks to mitigate the iteration over tasks that should not be resurrected, ensuring that only valid tasks are processed.

References