CVE-2026-52991: Linux Kernel Cgroup Use-After-Free Race Condition (CVSS 7.8)

Technical summary

The vulnerability exists in the cgroup pressure write path where a race condition allows access to a freed priv structure member of kernfs_open_file. The issue manifests in two scenarios: (1) pressure_write() accesses of->priv after cgroup_file_release() has deallocated and nullified it, and (2) a derivation where cgroup_file_show() can trigger file release between cgroup_kn_lock_live() and the subsequent cgroup_mutex acquisition, leaving of->priv in a potentially NULL state. The root cause is inadequate mutual exclusion—the cgroup_mutex does not fully protect all code paths that read of->priv within pressure_write(). The fix extends cgroup_mutex coverage to encompass all priv accesses, defers the ctx retrieval to after the live kernel-ns (kn) lock is held (ensuring the priv pointer is valid), and adds a NULL check to handle the derivative race condition.

Business impact

An unprivileged local attacker can trigger a kernel use-after-free condition, resulting in denial of service (system crash) or potential privilege escalation. In containerized or virtualized environments where multiple tenants share a kernel, this becomes a lateral privilege escalation vector. The impact is high severity because it requires only local user privileges and no user interaction, affecting the stability and security boundary of the kernel itself.

Affected systems

All Linux kernel versions containing the vulnerable pressure_write() implementation in kernel/cgroup/cgroup.c are affected. The specific range requires verification against the Linux kernel source history, as patch version data is not provided in the advisory. Affected systems include any running a vulnerable kernel version with CONFIG_PSI enabled and cgroup v2 support, which is increasingly common in modern distributions.

Exploitability

Exploitability is straightforward for a local attacker. The race condition is relatively easy to trigger under typical multi-core conditions due to the tight timing window involved in concurrent cgroup deletion and pressure metric writes. No special kernel configuration, privileges beyond standard local user, or complex gadget chains are required. However, successful exploitation depends on precise CPU scheduling alignment, which may require repeated attempts or specialized timing techniques.

Remediation

Apply the kernel patch that extends cgroup_mutex protection within pressure_write() to cover all of->priv accesses, moves the ctx retrieval point to after cgroup_kn_lock_live() acquisition, and adds a NULL check for of->priv. This eliminates both race conditions by ensuring proper synchronization between pressure write operations and cgroup file release. Verify against the Linux kernel security advisory for the exact patch version and backport availability for your kernel series.

Patch guidance

Monitor Linux kernel security advisories and your distribution's kernel updates for a patch addressing CVE-2026-52991. If you maintain a custom or stable kernel, apply the upstream patch once released or backport the fix from the Linux kernel stable/mainline repository. Test the patched kernel in a non-production environment before rolling out to production systems, particularly in container orchestration or multi-tenant deployments where the race is more likely to manifest.

Detection guidance

Detection requires kernel-level monitoring. Enable KASAN (Kernel Address Sanitizer) or CONFIG_DEBUG_KMEMLEAK in development/testing environments to catch use-after-free conditions. In production, monitor kernel logs for KASAN warnings or BUG messages related to pressure_write() and cgroup file operations. Container runtime logs may show unexpected OOM or kernel panic events. Network-based detection is not feasible; focus on host-level kernel instrumentation and system stability metrics.

Why prioritize this

This vulnerability merits urgent attention because it affects core kernel scheduling and cgroup infrastructure with high CVSS (7.8), requires only local access, and has straightforward exploitability in multi-core systems. Kernel vulnerabilities are systemic—a single compromised system can cascade to affect containers or virtual machines sharing that kernel. Organizations running container platforms, shared hosting, or multi-tenant infrastructure should prioritize patching. It is not yet in the CISA KEV catalog, but that does not reduce its practical risk.

Risk score, explained

CVSS 7.8 (HIGH) reflects a local attack vector (AV:L), low complexity (AC:L), low privilege requirement (PR:L), no user interaction (UI:N), and high impact across confidentiality, integrity, and availability (C:H/I:H/A:H). The score appropriately captures the severity of an unprivileged local use-after-free that can crash the kernel or lead to privilege escalation, although the practical exploitability depends on race condition timing.

Frequently asked questions