CVE-2026-52991
What it is
In the Linux kernel, the following vulnerability has been resolved: sched/psi: fix race between file release and pressure write A potential race condition exists between pressure write and cgroup file release regarding the priv member of struct kernfs_open_file, which triggers the uaf reported in [1]. Consider the following scenario involving execution on two separate CPUs: CPU0 CPU1 ==== ==== vfs_rmdir() kernfs_iop_rmdir() cgroup_rmdir() cgroup_kn_lock_live() cgroup_destroy_locked() cgroup_addrm_files() cgroup_rm_file() kernfs_remove_by_name() kernfs_remove_by_name_ns() vfs_write() __kernfs_remove() new_sync_write() kernfs_drain() kernfs_fop_write_iter() kernfs_drain_open_files() cgroup_file_write() kernfs_release_file() pressure_write() cgroup_file_release() ctx = of->priv; kfree(ctx); of->priv = NULL; cgroup_kn_unlock() cgroup_kn_lock_live() cgroup_get(cgrp) cgroup_kn_unlock() if (ctx->psi.trigger) // here, trigger uaf for ctx, that is of->priv The cgroup_rmdir() is protected by the cgroup_mutex, it also safeguards the memory deallocation of of->priv performed within cgroup_file_release(). However, the operations involving of->priv executed within pressure_write() are not entirely covered by the protection of cgroup_mutex. Consequently, if the code in pressure_write(), specifically the section handling the ctx variable executes after cgroup_file_release() has completed, a uaf vulnerability involving of->priv is triggered. Therefore, the issue can be resolved by extending the scope of the cgroup_mutex lock within pressure_write() to encompass all code paths involving of->priv, thereby properly synchronizing the race condition occurring between cgroup_file_release() and pressure_write(). And, if an live kn lock can be successfully acquired while executing the pressure write operation, it indicates that the cgroup deletion process has not yet reached its final stage; consequently, the priv pointer within open_file cannot be NULL. Therefore, the operation to retrieve the ctx value must be moved to a point *after* the live kn lock has been successfully acquired. In another situation, specifically after entering cgroup_kn_lock_live() but before acquiring cgroup_mutex, there exists a different class of race condition: CPU0: write memory.pressure CPU1: write cgroup.pressure=0 =========================== ============================= kernfs_fop_write_iter() kernfs_get_active_of(of) pressure_write() cgroup_kn_lock_live(memory.pressure) cgroup_tryget(cgrp) kernfs_break_active_protection(kn) ... blocks on cgroup_mutex cgroup_pressure_write() cgroup_kn_lock_live(cgroup.pressure) cgroup_file_show(memory.pressure, false) kernfs_show(false) kernfs_drain_open_files() cgroup_file_release(of) kfree(ctx) of->priv = NULL cgroup_kn_unlock() ... acquires cgroup_mutex ctx = of->priv; // may now be NULL if (ctx->psi.trigger) // NULL dereference Consequently, there is a possibility that of->priv is NULL, the pressure write needs to check for this. Now that the scope of the cgroup_mutex has been expanded, the original explicit cgroup_get/put operations are no longer necessary, this is because acquiring/releasing the live kn lock inherently executes a cgroup get/put operation. [1] BUG: KASAN: slab-use-after-free in pressure_write+0xa4/0x210 kernel/cgroup/cgroup.c:4011 Call Trace: pressure_write+0xa4/0x210 kernel/cgroup/cgroup.c:4011 cgroup_file_write+0x36f/0x790 kernel/cgroup/cgroup.c:43 ---truncated---
At a glance
- Exploitability
- Can be exploited locally on the machine with a low-privilege account. High risk of data exposure, data tampering, service disruption.
- Exploit odds
- 0.1% chance of exploitation in the next 30 days (EPSS).
- Fix
- A patch, advisory or fixed version is referenced. Upgrade or apply it.
Timeline
- PublishedDisclosed publicly on CVE.org and NVD
- Last updatedMost recent change to the record
Why it ranks here
- Exploited in the wild: no, CISA does not list it.
- Exploit odds: 0.1% in the next 30 days (EPSS).
- Severity: 7.8 HIGH (CVSS).
- Fix: a patch or advisory is linked.
Details
- Published
- Last modified
- Exploit probability
- 0.1% · EPSS, next 30 days
- Weakness
- CWE-362 · Race condition
- Record status
- Modified
Affected
- Linux Kernel < 6.18.33
- Linux Kernel < 7.0.10
- Linux Kernel 7.1
Attack profile CVSS 3.1 · 7.8
- Attack vector
- Local
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
- Scope
- Unchanged
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Raw vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Is it in your code?
Hand this to your coding agent. It searches your project for the affected products and checks versions. Nothing leaves your machine.
Read https://cve-list.com/agent/cve/CVE-2026-52991.md and follow it. Check whether this project is affected by CVE-2026-52991. Read only. Don't change anything and don't upload my code. Tell me yes, no or not sure, with the file as proof.
Fix and advisories
- https://git.kernel.org/stable/c/03dc070fa0fc3cb4068693f468ccd5f8a7e58282
- https://git.kernel.org/stable/c/a5b98009f16d8a5fb4a8ff9a193f5735515c38fa
- https://git.kernel.org/stable/c/d4352c0709bfd38c752fccbde7fd72a82ac78f23
References
- https://git.kernel.org/stable/c/03dc070fa0fc3cb4068693f468ccd5f8a7e58282
- https://git.kernel.org/stable/c/58e6ca11e45c9d6e52255d1135e7dbff0a360334
- https://git.kernel.org/stable/c/a5b98009f16d8a5fb4a8ff9a193f5735515c38fa
- https://git.kernel.org/stable/c/af0638534bfae7980582c6482531a0872f8ee341
- https://git.kernel.org/stable/c/d4352c0709bfd38c752fccbde7fd72a82ac78f23
- https://git.kernel.org/stable/c/d8ddbc3330fa6851c56b046e630a8fc64830a0ce
- https://access.redhat.com/errata/RHSA-2026:57251
- https://access.redhat.com/errata/RHSA-2026:57252
- https://access.redhat.com/errata/RHSA-2026:57253
- https://access.redhat.com/errata/RHSA-2026:57254
- https://access.redhat.com/security/cve/CVE-2026-52991
- https://bugzilla.redhat.com/show_bug.cgi?id=2492403
- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-52991.json