CVE-2026-98536
Received Received - Intake

Tasks-RCU Quiescent State Stalled in Linux Kernel Writeback

Publication date: 2026-10-18

Last updated on: 2026-10-18

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: writeback: report a Tasks-RCU quiescent state per cgwb drain pass cleanup_offline_cgwbs_workfn() drains a dying cgwb by calling cleanup_offline_cgwb() until it returns false, with a cond_resched() between passes. On a CONFIG_PREEMPTION kernel that cond_resched() does nothing: _cond_resched() is a plain "return 0", and under PREEMPT_DYNAMIC the full and lazy modes disable it. Since commit 7dadeaa6e851 ("sched: Further restrict the preemption modes") those are the only two models on the architectures with PREEMPT_LAZY support, arm64 and x86 among them, so the drain loop never reports a Tasks-RCU quiescent state. A worker draining a cgwb with millions of attached inodes runs for minutes. On a 6.18 arm64 host in lazy mode the cgwb worker drained one dying cgroup's writeback domain for over 11 minutes. A BPF program unlink (bpf_trampoline_unlink_prog -> bpf_trampoline_update -> unregister_ftrace_direct -> ftrace_shutdown -> synchronize_rcu_tasks()) waited on that grace period while holding the trampoline mutex, 42 tasks queued behind it in D state, and the hung task detector fired at 614 s and panicked the host. Any BPF or ftrace detach during a long drain inherits the drain's length. Fix this by calling cond_resched_tasks_rcu_qs() so we do not stall out anybody who calls sycnrhonize_rcu_tasks(). We put this in a do { } while loop because if we have many small cgroups cleanup_offline_cgwb() will return false and we will never call cond_resched_tasks_rcu_qs(), creating the same problem.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-18
Last Modified
2026-10-18
Generated
2026-10-18
AI Q&A
2026-10-18
EPSS Evaluated
N/A
NVD
CVE-2026-98536
EUVD
EUVD-2026-103581

Affected Vendors & Products

Showing 8 associated CPEs
Vendor Product Version / Range
Linux Linux c22d70a162d3cc177282c4487be4d54876ca55c8
Linux Linux c22d70a162d3cc177282c4487be4d54876ca55c8
Linux Linux c22d70a162d3cc177282c4487be4d54876ca55c8
Linux Linux c22d70a162d3cc177282c4487be4d54876ca55c8
Linux Linux c22d70a162d3cc177282c4487be4d54876ca55c8
Linux Linux c22d70a162d3cc177282c4487be4d54876ca55c8
Linux Linux c22d70a162d3cc177282c4487be4d54876ca55c8
Linux Linux 5.14

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in the Linux kernel involves a Tasks-RCU quiescent state reporting issue during cgwb (cgroup writeback) drain operations. The cleanup_offline_cgwbs_workfn() function drains a dying cgwb by repeatedly calling cleanup_offline_cgwb() without properly reporting a quiescent state to the RCU (Read-Copy-Update) subsystem. This happens because cond_resched() does not work as expected in certain kernel configurations, leading to long-running operations that stall other critical tasks like BPF program unlinking.

Detection Guidance

This vulnerability is specific to the Linux kernel and involves a stall in Tasks-RCU quiescent state reporting during cgwb drain operations. Detection requires checking kernel logs for hung tasks or RCU stalls during writeback operations. Monitor for processes stuck in D state during cgwb cleanup. Check dmesg for RCU-related warnings or hung task detector messages.

Impact Analysis

This vulnerability can cause system hangs or crashes when certain operations like BPF program unlinking or ftrace detachment occur during a long cgwb drain. The host may panic due to the hung task detector firing after prolonged delays, resulting in downtime or service disruption. Systems with many inodes or cgroups are particularly affected.

Mitigation Strategies

Apply the kernel patch that introduces cond_resched_tasks_rcu_qs() in the cleanup_offline_cgwbs_workfn() loop. Update to a fixed kernel version where this issue is resolved. Monitor systems for long-running cgwb drain operations and ensure no BPF or ftrace detach operations occur during such periods.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-98536. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart