{“lastseen”:””,”description”:”In the Linux kernel, the following vulnerability has been resolved:\\n\\nsched\/psi: fix race between file release and pressure write\\n\\nA potential race condition exists between pressure write and cgroup file\\nrelease regarding the priv member of struct kernfs_open_file, which\\ntriggers the uaf reported in [1].\\n\\nConsider the following scenario involving execution on two separate CPUs:\\n\\n CPU0\\t\\t\\t\\t\\tCPU1\\n ====\\t\\t\\t\\t\\t====\\n\\t\\t\\t\\t\\tvfs_rmdir()\\n\\t\\t\\t\\t\\tkernfs_iop_rmdir()\\n\\t\\t\\t\\t\\tcgroup_rmdir()\\n\\t\\t\\t\\t\\tcgroup_kn_lock_live()\\n\\t\\t\\t\\t\\tcgroup_destroy_locked()\\n\\t\\t\\t\\t\\tcgroup_addrm_files()\\n\\t\\t\\t\\t\\tcgroup_rm_file()\\n\\t\\t\\t\\t\\tkernfs_remove_by_name()\\n\\t\\t\\t\\t\\tkernfs_remove_by_name_ns()\\n vfs_write()\\t\\t\\t\\t__kernfs_remove()\\n new_sync_write()\\t\\t\\tkernfs_drain()\\n kernfs_fop_write_iter()\\t\\tkernfs_drain_open_files()\\n cgroup_file_write()\\t\\t\\tkernfs_release_file()\\n pressure_write()\\t\\t\\tcgroup_file_release()\\n ctx = of-\\u003epriv;\\n\\t\\t\\t\\t\\tkfree(ctx);\\n \\t\\t\\t\\t\\tof-\\u003epriv = NULL;\\n\\t\\t\\t\\t\\tcgroup_kn_unlock()\\n cgroup_kn_lock_live()\\n cgroup_get(cgrp)\\n cgroup_kn_unlock()\\n if (ctx-\\u003epsi.trigger) \/\/ here, trigger uaf for ctx, that is of-\\u003epriv\\n\\nThe cgroup_rmdir() is protected by the cgroup_mutex, it also safeguards\\nthe memory deallocation of of-\\u003epriv performed within cgroup_file_release().\\nHowever, the operations involving of-\\u003epriv executed within pressure_write()\\nare not entirely covered by the protection of cgroup_mutex. Consequently,\\nif the code in pressure_write(), specifically the section handling the\\nctx variable executes after cgroup_file_release() has completed, a uaf\\nvulnerability involving of-\\u003epriv is triggered.\\n\\nTherefore, the issue can be resolved by extending the scope of the\\ncgroup_mutex lock within pressure_write() to encompass all code paths\\ninvolving of-\\u003epriv, thereby properly synchronizing the race condition\\noccurring between cgroup_file_release() and pressure_write().\\n\\nAnd, if an live kn lock can be successfully acquired while executing\\nthe pressure write operation, it indicates that the cgroup deletion\\nprocess has not yet reached its final stage; consequently, the priv\\npointer within open_file cannot be NULL. Therefore, the operation to\\nretrieve the ctx value must be moved to a point *after* the live kn\\nlock has been successfully acquired.\\n\\nIn another situation, specifically after entering cgroup_kn_lock_live()\\nbut before acquiring cgroup_mutex, there exists a different class of\\nrace condition:\\n\\nCPU0: write memory.pressure CPU1: write cgroup.pressure=0\\n===========================\\t\\t =============================\\n\\nkernfs_fop_write_iter()\\n kernfs_get_active_of(of)\\n pressure_write()\\n cgroup_kn_lock_live(memory.pressure)\\n cgroup_tryget(cgrp)\\n kernfs_break_active_protection(kn)\\n … blocks on cgroup_mutex\\n\\n \\t cgroup_pressure_write()\\n \\t cgroup_kn_lock_live(cgroup.pressure)\\n \\t cgroup_file_show(memory.pressure, false)\\n \\t kernfs_show(false)\\n \\t kernfs_drain_open_files()\\n \\t cgroup_file_release(of)\\n \\t kfree(ctx)\\n \\t of-\\u003epriv = NULL\\n \\t cgroup_kn_unlock()\\n\\n … acquires cgroup_mutex\\n ctx = of-\\u003epriv; \/\/ may now be NULL\\n if (ctx-\\u003epsi.trigger) \/\/ NULL dereference\\n\\nConsequently, there is a possibility that of-\\u003epriv is NULL, the pressure\\nwrite needs to check for this.\\n\\nNow that the scope of the cgroup_mutex has been expanded, the original\\nexplicit cgroup_get\/put operations are no longer necessary, this is\\nbecause acquiring\/releasing the live kn lock inherently executes a\\ncgroup get\/put operation.\\n\\n[1]\\nBUG: KASAN: slab-use-after-free in pressure_write+0xa4\/0x210 kernel\/cgroup\/cgroup.c:4011\\nCall Trace:\\n pressure_write+0xa4\/0x210 kernel\/cgroup\/cgroup.c:4011\\n cgroup_file_write+0x36f\/0x790 kernel\/cgroup\/cgroup.c:43\\n—truncated—“,”published”:”2026-06-24T16:29:04.810Z”,”modified”:”2026-06-28T06:37:44.993Z”,”type”:”cve”,”title”:”sched\/psi: fix race between file release and pressure write”,”source”:”Linux”,”references”:”https:\/\/git.kernel.org\/stable\/c\/03dc070fa0fc3cb4068693f468ccd5f8a7e58282\\nhttps:\/\/git.kernel.org\/stable\/c\/d4352c0709bfd38c752fccbde7fd72a82ac78f23\\nhttps:\/\/git.kernel.org\/stable\/c\/a5b98009f16d8a5fb4a8ff9a193f5735515c38fa”,”id”:”CVE-2026-52991″,”bulletinFamily”:””,”cwe”:null,”cvelist”:null,”sourceData”:”Linux Linux 0e94682b73bfa6c44c98af7a26771c9c08c055d5\\nLinux Linux 0e94682b73bfa6c44c98af7a26771c9c08c055d5\\nLinux Linux 0e94682b73bfa6c44c98af7a26771c9c08c055d5\\nLinux Linux 5.2″,”sourceHref”:””,”cvss”:{“score”:7.8,”severity”:”HIGH”,”vector”:”CVSS:3.1\/AV:L\/AC:L\/PR:L\/UI:N\/S:U\/C:H\/I:H\/A:H”,”version”:”3.1″},”cvss2″:{},”cvss3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””,”cvssV3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””}},”href”:””,”category_name”:”CVE”,”post_link”:””,”product”:”Linux”,”version”:”0e94682b73bfa6c44c98af7a26771c9c08c055d5″,”vendor”:”Linux”,”ai_description”:””,”ai_severity”:””,”ai_vendor”:””,”ai_product”:””,”ai_version”:””,”ai_score”:0}<\/p>\n","protected":false},"excerpt":{"rendered":"
{“lastseen”:””,”description”:”In the Linux kernel, the following vulnerability has been resolved:\\n\\nsched\/psi: fix race between file release and pressure write\\n\\nA potential race condition exists between pressure write…<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[2],"tags":[6,8,28,12,15,13,7,11,5],"class_list":["post-66568","post","type-post","status-publish","format-standard","hentry","category-category_cve","tag-cve","tag-cvss","tag-cvss-78","tag-exploit","tag-high","tag-news","tag-security","tag-tapic","tag-vulnerability"],"yoast_head":"\n