CVE-2026-52991

Description

In the Linux kernel, the following vulnerability has been resolved: sched/psi: fix race between file release and pressure write A potential race condition exists between pressure write and cgroup file release regarding the priv member of struct kernfs_open_file, which triggers the uaf reported in [1]. Consider the following scenario involving execution on two separate CPUs: CPU0 CPU1 ==== ==== vfs_rmdir() kernfs_iop_rmdir() cgroup_rmdir() cgroup_kn_lock_live() cgroup_destroy_locked() cgroup_addrm_files() cgroup_rm_file() kernfs_remove_by_name() kernfs_remove_by_name_ns() vfs_write() __kernfs_remove() new_sync_write() kernfs_drain() kernfs_fop_write_iter() kernfs_drain_open_files() cgroup_file_write() kernfs_release_file() pressure_write() cgroup_file_release() ctx = of->priv; kfree(ctx); of->priv = NULL; cgroup_kn_unlock() cgroup_kn_lock_live() cgroup_get(cgrp) cgroup_kn_unlock() if (ctx->psi.trigger) // here, trigger uaf for ctx, that is of->priv The cgroup_rmdir() is protected by the cgroup_mutex, it also safeguards the memory deallocation of of->priv performed within cgroup_file_release(). However, the operations involving of->priv executed within pressure_write() are not entirely covered by the protection of cgroup_mutex. Consequently, if the code in pressure_write(), specifically the section handling the ctx variable executes after cgroup_file_release() has completed, a uaf vulnerability involving of->priv is triggered. Therefore, the issue can be resolved by extending the scope of the cgroup_mutex lock within pressure_write() to encompass all code paths involving of->priv, thereby properly synchronizing the race condition occurring between cgroup_file_release() and pressure_write(). And, if an live kn lock can be successfully acquired while executing the pressure write operation, it indicates that the cgroup deletion process has not yet reached its final stage; consequently, the priv pointer within open_file cannot be NULL. Therefore, the operation to retrieve the ctx value must be moved to a point *after* the live kn lock has been successfully acquired. In another situation, specifically after entering cgroup_kn_lock_live() but before acquiring cgroup_mutex, there exists a different class of race condition: CPU0: write memory.pressure CPU1: write cgroup.pressure=0 =========================== ============================= kernfs_fop_write_iter() kernfs_get_active_of(of) pressure_write() cgroup_kn_lock_live(memory.pressure) cgroup_tryget(cgrp) kernfs_break_active_protection(kn) ... blocks on cgroup_mutex cgroup_pressure_write() cgroup_kn_lock_live(cgroup.pressure) cgroup_file_show(memory.pressure, false) kernfs_show(false) kernfs_drain_open_files() cgroup_file_release(of) kfree(ctx) of->priv = NULL cgroup_kn_unlock() ... acquires cgroup_mutex ctx = of->priv; // may now be NULL if (ctx->psi.trigger) // NULL dereference Consequently, there is a possibility that of->priv is NULL, the pressure write needs to check for this. Now that the scope of the cgroup_mutex has been expanded, the original explicit cgroup_get/put operations are no longer necessary, this is because acquiring/releasing the live kn lock inherently executes a cgroup get/put operation. [1] BUG: KASAN: slab-use-after-free in pressure_write+0xa4/0x210 kernel/cgroup/cgroup.c:4011 Call Trace: pressure_write+0xa4/0x210 kernel/cgroup/cgroup.c:4011 cgroup_file_write+0x36f/0x790 kernel/cgroup/cgroup.c:43 ---truncated---

CVSS Metrics

• v3.1•HIGH•Score: 7.8CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
• v3.1•HIGH•Score: 7CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS Trends

Current EPSS score: 0.11%• Percentile: 2%

Techniques & Countermeasures

• CWE-362•Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

  The product contains a concurrent code sequence that requires temporary, exclusive access to a shared resource, but a timing window exists in which the shared resource can be modified by another code sequence operating concurrently.

• CWE-367•Time-of-check Time-of-use (TOCTOU) Race Condition

  The product checks the state of a resource before using that resource, but the resource's state can change between the check and the use in a way that invalidates the results of the check.

Affected Systems

• chainguard•linux-aws-6.12

  all

• chainguard•linux-azure-6.12

  all

• chainguard•linux-gcp-6.12

  all

• chainguard•linux-qemu-6.12

  all

• chainguard•linux-vmware-6.12

  all

• debian•linux

  all | all | all | < 7.0.10-1

• ubuntu•linux

  all | all | all | all | < 7.0.0-28.28

• ubuntu•linux-allwinner-5.19

  all

• ubuntu•linux-aws

  all | all | all | all | < 7.0.0-1009.9

• ubuntu•linux-aws-5.0

  all

• ubuntu•linux-aws-5.11

  all

• ubuntu•linux-aws-5.13

  all

• ubuntu•linux-aws-5.15

  all

• ubuntu•linux-aws-5.19

  all

• ubuntu•linux-aws-5.3

  all

• ubuntu•linux-aws-5.4

  all

• ubuntu•linux-aws-5.8

  all

• ubuntu•linux-aws-6.14

  all

• ubuntu•linux-aws-6.17

  all

• ubuntu•linux-aws-6.2

  all

• ubuntu•linux-aws-6.5

  all

• ubuntu•linux-aws-6.8

  all

• ubuntu•linux-aws-fips

  all

• ubuntu•linux-azure

  all | all | all | all | all | < 7.0.0-1010.10

• ubuntu•linux-azure-5.11

  all

• ubuntu•linux-azure-5.13

  all

• ubuntu•linux-azure-5.15

  all

• ubuntu•linux-azure-5.19

  all

• ubuntu•linux-azure-5.3

  all

• ubuntu•linux-azure-5.4

  all

• ubuntu•linux-azure-5.8

  all

• ubuntu•linux-azure-6.11

  all

• ubuntu•linux-azure-6.14

  all

• ubuntu•linux-azure-6.17

  all

• ubuntu•linux-azure-6.2

  all

• ubuntu•linux-azure-6.5

  all

• ubuntu•linux-azure-6.8

  all

• ubuntu•linux-azure-7.0

  all

• ubuntu•linux-azure-edge

  all

• ubuntu•linux-azure-fde

  all | all | all | all | < 7.0.0-1009.9

• ubuntu•linux-azure-fde-5.15

  all

• ubuntu•linux-azure-fde-5.19

  all

• ubuntu•linux-azure-fde-6.14

  all

• ubuntu•linux-azure-fde-6.17

  all

• ubuntu•linux-azure-fde-6.2

  all

• ubuntu•linux-azure-fde-6.8

  all

• ubuntu•linux-azure-fips

  all

• ubuntu•linux-azure-nvidia

  all

• ubuntu•linux-azure-nvidia-6.14

  all

• ubuntu•linux-bluefield

  all | all

Showing first 50 affected entries in server-rendered view.

References (27)

• https://git.kernel.org/stable/c/03dc070fa0fc3cb4068693f468ccd5f8a7e58282
• https://git.kernel.org/stable/c/d4352c0709bfd38c752fccbde7fd72a82ac78f23
• https://git.kernel.org/stable/c/a5b98009f16d8a5fb4a8ff9a193f5735515c38fa
• https://access.redhat.com/security/cve/CVE-2026-52991
• https://bugzilla.redhat.com/show_bug.cgi?id=2492403
• https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-52991.json
• https://ubuntu.com/security/CVE-2026-52991
• https://www.cve.org/CVERecord?id=CVE-2026-52991
• https://git.kernel.org/linus/a5b98009f16d8a5fb4a8ff9a193f5735515c38fa
• https://ubuntu.com/security/notices/USN-8566-1
• https://ubuntu.com/security/notices/USN-8568-1
• https://ubuntu.com/security/notices/USN-8569-1
• https://ubuntu.com/security/notices/USN-8593-1
• https://ubuntu.com/security/notices/USN-8603-1
• https://ubuntu.com/security/notices/USN-8618-1
• https://security-tracker.debian.org/tracker/CVE-2026-52991
• https://access.redhat.com/errata/RHSA-2026:57251
• https://access.redhat.com/errata/RHSA-2026:57252
• https://access.redhat.com/errata/RHSA-2026:57253
• https://access.redhat.com/errata/RHSA-2026:57254
• https://ubuntu.com/security/notices/USN-8663-1
• https://ubuntu.com/security/notices/USN-8664-1
• https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/52xxx/CVE-2026-52991.json
• https://nvd.nist.gov/vuln/detail/CVE-2026-52991
• https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
• https://ubuntu.com/security/notices/USN-8728-1
• https://ubuntu.com/security/notices/USN-8781-1