CVE-2026-43439
Race Condition in Linux Kernel Cgroup Migration
Publication date: 2026-05-08
Last updated on: 2026-05-08
Assigner: kernel.org
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| linux | linux_kernel | * |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-UNKNOWN |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability involves a race condition in the Linux kernel's cgroup subsystem during task migration and iteration. When a task is moved from one cgroup to another, the internal lists tracking tasks are updated. However, if an iterator is currently traversing the task list, it may become invalid because the task has been moved to a different list. This causes the iterator to skip some tasks during iteration, leading to incomplete or incorrect task listings.
The issue arises because the iterator advances relative to the wrong list after the task is moved, causing some tasks to be skipped. The fix involves advancing all active iterators before unlinking the task from the original list, ensuring iteration continues correctly even when migration and iteration happen concurrently.
This race condition is difficult to trigger in normal operation but can be reproduced by artificially slowing down the cgroup process listing and migrating tasks concurrently.
How can this vulnerability impact me? :
This vulnerability can cause the cgroup process listing to intermittently skip some tasks during migration, leading to incomplete or inaccurate information about which tasks belong to a cgroup.
While this does not directly cause crashes or security breaches, it can result in misleading system monitoring or management data, potentially affecting system administrators' ability to accurately track and control processes within cgroups.
The race condition is rare and hard to trigger without special instrumentation, so the practical impact is limited but important for correctness in systems relying on accurate cgroup task information.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by reproducing the race condition between task migration and iteration in cgroups. One method involves artificially slowing down the cgroup_procs_show() function to observe if tasks are intermittently skipped during iteration.
- Add a temporary delay knob via /sys/kernel/cgroup/cgroup_test to inject a delay into cgroup_procs_show().
- Spawn three long-running tasks (for example, with PIDs 101, 102, and 103).
- Create a test cgroup and move these tasks into it.
- Enable a large delay using the /sys/kernel/cgroup/cgroup_test interface.
- In one shell, read the cgroup.procs file from the test cgroup.
- Within the delay window, in another shell, migrate one of the tasks (e.g., PID 102) by writing it to a different cgroup.procs file.
If the vulnerability is present, cgroup.procs may intermittently show only some of the tasks (e.g., PID 101) while skipping others (e.g., PID 103). After migration completes, reading the file again should show all tasks.
What immediate steps should I take to mitigate this vulnerability?
The vulnerability has been fixed in the Linux kernel by adding a call to css_set_skip_task_iters() before unlinking a task from the tasks list during migration. To mitigate this vulnerability immediately, you should update your Linux kernel to a version that includes this fix.
Since the race window is very small and the issue is related to internal kernel cgroup task iteration, no specific configuration changes or workarounds are described. Applying the kernel patch or upgrading to a fixed kernel version is the recommended mitigation.