[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"repo-stars":3,"vuln-DEBIAN-CVE-2026-52991":6},{"stargazers_count":4,"fetched_at":5},8,"2026-09-19T04:32:17.889Z",{"id":7,"descriptions":8,"cisa":9,"weaknesses":10,"exploits":11,"aliases":12,"duplicate_of":9,"upstream":13,"downstream":16,"duplicates":17,"related":18,"reserved_at":9,"published_at":19,"modified_at":20,"state":9,"summary":21,"references_raw":23,"kevs":30,"epss":9,"epss_history":31,"metrics":32,"affected":39},"DEBIAN-CVE-2026-52991","In the Linux kernel, the following vulnerability has been resolved:  sched/psi: fix race between file release and pressure write  A potential race condition exists between pressure write and cgroup file release regarding the priv member of struct kernfs_open_file, which triggers the uaf reported in [1].  Consider the following scenario involving execution on two separate CPUs:     CPU0\t\t\t\t\tCPU1    ====\t\t\t\t\t==== \t\t\t\t\tvfs_rmdir() \t\t\t\t\tkernfs_iop_rmdir() \t\t\t\t\tcgroup_rmdir() \t\t\t\t\tcgroup_kn_lock_live() \t\t\t\t\tcgroup_destroy_locked() \t\t\t\t\tcgroup_addrm_files() \t\t\t\t\tcgroup_rm_file() \t\t\t\t\tkernfs_remove_by_name() \t\t\t\t\tkernfs_remove_by_name_ns()  vfs_write()\t\t\t\t__kernfs_remove()  new_sync_write()\t\t\tkernfs_drain()  kernfs_fop_write_iter()\t\tkernfs_drain_open_files()  cgroup_file_write()\t\t\tkernfs_release_file()  pressure_write()\t\t\tcgroup_file_release()  ctx = of->priv; \t\t\t\t\tkfree(ctx);  \t\t\t\t\tof->priv = NULL; \t\t\t\t\tcgroup_kn_unlock()  cgroup_kn_lock_live()  cgroup_get(cgrp)  cgroup_kn_unlock()  if (ctx->psi.trigger)  // here, trigger uaf for ctx, that is of->priv  The cgroup_rmdir() is protected by the cgroup_mutex, it also safeguards the memory deallocation of of->priv performed within cgroup_file_release(). However, the operations involving of->priv executed within pressure_write() are not entirely covered by the protection of cgroup_mutex. Consequently, if the code in pressure_write(), specifically the section handling the ctx variable executes after cgroup_file_release() has completed, a uaf vulnerability involving of->priv is triggered.  Therefore, the issue can be resolved by extending the scope of the cgroup_mutex lock within pressure_write() to encompass all code paths involving of->priv, thereby properly synchronizing the race condition occurring between cgroup_file_release() and pressure_write().  And, if an live kn lock can be successfully acquired while executing the pressure write operation, it indicates that the cgroup deletion process has not yet reached its final stage; consequently, the priv pointer within open_file cannot be NULL. Therefore, the operation to retrieve the ctx value must be moved to a point *after* the live kn lock has been successfully acquired.  In another situation, specifically after entering cgroup_kn_lock_live() but before acquiring cgroup_mutex, there exists a different class of race condition:  CPU0: write memory.pressure               CPU1: write cgroup.pressure=0 ===========================\t\t  =============================  kernfs_fop_write_iter()  kernfs_get_active_of(of)  pressure_write()    cgroup_kn_lock_live(memory.pressure)      cgroup_tryget(cgrp)      kernfs_break_active_protection(kn)      ... blocks on cgroup_mutex                                       \t  cgroup_pressure_write()                                      \t  cgroup_kn_lock_live(cgroup.pressure)                                      \t  cgroup_file_show(memory.pressure, false)                                      \t    kernfs_show(false)                                      \t      kernfs_drain_open_files()                                      \t        cgroup_file_release(of)                                      \t          kfree(ctx)                                      \t            of->priv = NULL                                      \t  cgroup_kn_unlock()     ... acquires cgroup_mutex    ctx = of->priv;        // may now be NULL    if (ctx->psi.trigger)  // NULL dereference  Consequently, there is a possibility that of->priv is NULL, the pressure write needs to check for this.  Now that the scope of the cgroup_mutex has been expanded, the original explicit cgroup_get/put operations are no longer necessary, this is because acquiring/releasing the live kn lock inherently executes a cgroup get/put operation.  [1] BUG: KASAN: slab-use-after-free in pressure_write+0xa4/0x210 kernel/cgroup/cgroup.c:4011 Call Trace:  pressure_write+0xa4/0x210 kernel/cgroup/cgroup.c:4011  cgroup_file_write+0x36f/0x790 kernel/cgroup/cgroup.c:43 ---truncated---",null,[],[],[],[14],{"_key":15},"CVE-2026-52991",[],[],[],"2026-06-24T17:17:09.953Z","2026-06-30T00:00:08.227828827Z",{"cisa_kev":22,"cisa_ransomware":22,"cisa_vendor":9,"epss_severity":9,"epss_score":9,"severity":9,"severity_score":9,"severity_version":9,"severity_source":9,"severity_vector":9,"severity_status":9},false,[24],{"url":25,"sources":26,"tags":28},"https://security-tracker.debian.org/tracker/CVE-2026-52991",[27],"osv_debian",[29],"Advisory",[],[],[33],{"source":27,"cvss_v2_0":9,"cvss_v3_0":9,"cvss_v3_1":34,"cvss_v4_0":9},{"baseScore":35,"baseSeverity":9,"vectorString":36,"impactScore":37,"exploitabilityScore":38},7.8,"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",9.8,4.6,[40],{"ecosystem":41,"name":42,"vendor":43,"product":42,"cpe_part":9,"purl_type":44,"purl_namespace":43,"purl_name":42,"source":9,"versions":45},"Debian","linux","debian","deb",[46,50,51,52],{"version":47,"is_range":48,"range_type":49,"version_start":9,"version_start_type":9,"version_end":9,"version_end_type":9,"fixed_in":9},"all",true,"ecosystem",{"version":47,"is_range":48,"range_type":49,"version_start":9,"version_start_type":9,"version_end":9,"version_end_type":9,"fixed_in":9},{"version":47,"is_range":48,"range_type":49,"version_start":9,"version_start_type":9,"version_end":9,"version_end_type":9,"fixed_in":9},{"version":53,"is_range":48,"range_type":49,"version_start":9,"version_start_type":9,"version_end":54,"version_end_type":55,"fixed_in":9},"lt7_0_10_1","7.0.10-1","excluding"]