All vulnerabilities
CVE-2026-98536

Linux: writeback: report a Tasks-RCU quiescent state per cgwb drain pass

Linux LinuxOperating systems
Open in ThreatlineRecord JSON
CVSS
NoneNot scored
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.21%Chance of exploitation activity in the next 30 days, higher than 11% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in863049b4018237d1590cd13b16e9fe9c0faad2c6Also 42462b5bb0dec57db7f85d0f77655c737d45754d, 4eb889649eaf65f4a5727b04ba1c017b7d05bb16 and 2 moreCVE List
Published18 Oct 2026Updated 19 Oct 2026CVE List

What fixes it

  • 863049b4018237d1590cd13b16e9fe9c0faad2c6LinuxCVE List
  • 42462b5bb0dec57db7f85d0f77655c737d45754dLinuxCVE List
  • 4eb889649eaf65f4a5727b04ba1c017b7d05bb16LinuxCVE List
  • 260f586a80e7f624dd7f069898a75a904f34d373LinuxCVE List
  • 407a5d205179a4ab186571b0e16ec42725dc77bcLinuxCVE List

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

In the Linux kernel, the following vulnerability has been resolved:

writeback: report a Tasks-RCU quiescent state per cgwb drain pass

cleanup_offline_cgwbs_workfn() drains a dying cgwb by calling cleanup_offline_cgwb() until it returns false, with a cond_resched() between passes. On a CONFIG_PREEMPTION kernel that cond_resched() does nothing: _cond_resched() is a plain "return 0", and under PREEMPT_DYNAMIC the full and lazy modes disable it. Since commit 7dadeaa6e851 ("sched: Further restrict the preemption modes") those are the only two models on the architectures with PREEMPT_LAZY support, arm64 and x86 among them, so the drain loop never reports a Tasks-RCU quiescent state.

A worker draining a cgwb with millions of attached inodes runs for minutes. On a 6.18 arm64 host in lazy mode the cgwb worker drained one dying cgroup's writeback domain for over 11 minutes. A BPF program unlink (bpf_trampoline_unlink_prog -> bpf_trampoline_update -> unregister_ftrace_direct -> ftrace_shutdown -> synchronize_rcu_tasks()) waited on that grace period while holding the trampoline mutex, 42 tasks queued behind it in D state, and the hung task detector fired at 614 s and panicked the host. Any BPF or ftrace detach during a long drain inherits the drain's length.

Fix this by calling cond_resched_tasks_rcu_qs() so we do not stall out anybody who calls sycnrhonize_rcu_tasks(). We put this in a do { } while loop because if we have many small cgroups cleanup_offline_cgwb() will return false and we will never call cond_resched_tasks_rcu_qs(), creating the same problem.

Text from CVE List

Affected versions 16

  • Linuxaffected: c22d70a162d3cc177282c4487be4d54876ca55c8 before 863049b4018237d1590cd13b16e9fe9c0faad2c6CVE List
  • Linuxaffected: c22d70a162d3cc177282c4487be4d54876ca55c8 before 42462b5bb0dec57db7f85d0f77655c737d45754dCVE List
  • Linuxaffected: c22d70a162d3cc177282c4487be4d54876ca55c8 before ebf1555ad2821be06f87a88ffd9a2cab8d2200e1CVE List
  • Linuxaffected: c22d70a162d3cc177282c4487be4d54876ca55c8 before 4eb889649eaf65f4a5727b04ba1c017b7d05bb16CVE List
  • Linuxaffected: c22d70a162d3cc177282c4487be4d54876ca55c8 before fd3bf32279df98751364b3609eb100a3e42f253bCVE List
  • Linuxaffected: c22d70a162d3cc177282c4487be4d54876ca55c8 before 260f586a80e7f624dd7f069898a75a904f34d373CVE List
  • Linuxaffected: c22d70a162d3cc177282c4487be4d54876ca55c8 before 407a5d205179a4ab186571b0e16ec42725dc77bcCVE List
  • Linuxaffected: 5.14CVE List
  • Linuxunaffected: all versions before 5.14CVE List
  • Linuxunaffected: 5.15.222 through 5.15.*CVE List
  • Linuxunaffected: 6.1.189 through 6.1.*CVE List
  • Linuxunaffected: 6.6.158 through 6.6.*CVE List
  • Linuxunaffected: 6.12.112 through 6.12.*CVE List
  • Linuxunaffected: 6.18.55 through 6.18.*CVE List
  • Linuxunaffected: 7.2.9 through 7.2.*CVE List
  • Linuxunaffected: 7.3CVE List

References 7