Race Condition Vulnerability in Linux Kernel Affecting Cgroup and Cpuset Operations

CVE-2026-99065

What is CVE-2026-99065?

A race condition vulnerability exists within the Linux Kernel's handling of cgroup and cpuset operations, specifically tied to CPU hotplug processes. Changes made to the cpuset hotplug operation aimed to synchronize the process; however, a flaw was introduced that allows a race condition to re-emerge. The improper handling of cpu_active_mask during CPU offline operations can lead to scenarios where the top cpuset fails to recognize any active CPUs, causing a NULL pointer dereference. This can result in undefined behavior or system instability when guarantee_active_cpus() is called. The issue is remedied by implementing a NULL check to ensure stability in the operations.

References