CVE-2026-98536
En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad:
writeback: informar de un estado de reposo Tasks-RCU por cada pasada de vaciado de cgwb
cleanup_offline_cgwbs_workfn() drena un cgwb que está terminando llamando a cleanup_offline_cgwb() hasta que devuelve false, con un cond_resched() entre pasadas. En un kernel con CONFIG_PREEMPTION, ese cond_resched() no hace nada: _cond_resched() es un simple "return 0", y con PREEMPT_DYNAMIC los modos full y lazy lo desactivan. Desde el commit 7dadeaa6e851 ("sched: Further restrict the preemption modes"), esos son los únicos dos modelos en las arquitecturas con soporte de PREEMPT_LAZY, entre ellas arm64 y x86, así que el bucle de vaciado nunca informa de un estado de reposo de Tasks-RCU.
Leer descripción completaMostrar menos
Un worker que vacía un cgwb con millones de inodos asociados se ejecuta durante minutos. En un host arm64 con 6.18 en modo lazy, el worker de cgwb tardó más de 11 minutos en vaciar el dominio de writeback de un cgroup que estaba terminando. Una desvinculación de un programa BPF (bpf_trampoline_unlink_prog -> bpf_trampoline_update -> unregister_ftrace_direct -> ftrace_shutdown -> synchronize_rcu_tasks()) esperó a ese periodo de gracia mientras mantenía el mutex del trampolín, con 42 tareas encoladas detrás de él en estado D, y el detector de tareas colgadas saltó a los 614 s y provocó un pánico en el host. Cualquier desvinculación de BPF o ftrace durante un vaciado largo hereda la duración de ese vaciado.
Para corregirlo, se llama a cond_resched_tasks_rcu_qs() para no bloquear a quien llame a sycnrhonize_rcu_tasks(). Lo ponemos dentro de un bucle do { } while porque, si hay muchos cgroups pequeños, cleanup_offline_cgwb() devolverá false y nunca llamaríamos a cond_resched_tasks_rcu_qs(), lo que provocaría el mismo problema.
Traducción automática del texto original de NVD (en inglés).
CVSS
NVD no ha asignado puntuación CVSS a esta CVE (habitual desde el cambio de política de abril de 2026).
Probabilidad de explotación (EPSS)
- Probabilidad de explotación en los próximos 30 días
- 0.21 %
- Percentil entre todas las CVEs puntuadas
- 11
- Fecha de la puntuación
- 20/10/2026
EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).
Tecnologías afectadas (1)
⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.
Referencias
Mostrar las 7 referencias
- https://git.kernel.org/stable/c/260f586a80e7f624dd7f069898a75a904f34d373
- https://git.kernel.org/stable/c/407a5d205179a4ab186571b0e16ec42725dc77bc
- https://git.kernel.org/stable/c/42462b5bb0dec57db7f85d0f77655c737d45754d
- https://git.kernel.org/stable/c/4eb889649eaf65f4a5727b04ba1c017b7d05bb16
- https://git.kernel.org/stable/c/863049b4018237d1590cd13b16e9fe9c0faad2c6
- https://git.kernel.org/stable/c/ebf1555ad2821be06f87a88ffd9a2cab8d2200e1
- https://git.kernel.org/stable/c/fd3bf32279df98751364b3609eb100a3e42f253b
JSON original (NVD)
Mostrar
{
"id": "CVE-2026-98536",
"cveTags": [],
"metrics": {},
"affected": [
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"affectedData": [
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "c22d70a162d3cc177282c4487be4d54876ca55c8",
"lessThan": "863049b4018237d1590cd13b16e9fe9c0faad2c6",
"versionType": "git"
},
{
"status": "affected",
"version": "c22d70a162d3cc177282c4487be4d54876ca55c8",
"lessThan": "42462b5bb0dec57db7f85d0f77655c737d45754d",
"versionType": "git"
},
{
"status": "affected",
"version": "c22d70a162d3cc177282c4487be4d54876ca55c8",
"lessThan": "ebf1555ad2821be06f87a88ffd9a2cab8d2200e1",
"versionType": "git"
},
{
"status": "affected",
"version": "c22d70a162d3cc177282c4487be4d54876ca55c8",
"lessThan": "4eb889649eaf65f4a5727b04ba1c017b7d05bb16",
"versionType": "git"
},
{
"status": "affected",
"version": "c22d70a162d3cc177282c4487be4d54876ca55c8",
"lessThan": "fd3bf32279df98751364b3609eb100a3e42f253b",
"versionType": "git"
},
{
"status": "affected",
"version": "c22d70a162d3cc177282c4487be4d54876ca55c8",
"lessThan": "260f586a80e7f624dd7f069898a75a904f34d373",
"versionType": "git"
},
{
"status": "affected",
"version": "c22d70a162d3cc177282c4487be4d54876ca55c8",
"lessThan": "407a5d205179a4ab186571b0e16ec42725dc77bc",
"versionType": "git"
}
],
"programFiles": [
"mm/backing-dev.c"
],
"defaultStatus": "unaffected"
},
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "5.14"
},
{
"status": "unaffected",
"version": "0",
"lessThan": "5.14",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "5.15.222",
"versionType": "semver",
"lessThanOrEqual": "5.15.*"
},
{
"status": "unaffected",
"version": "6.1.189",
"versionType": "semver",
"lessThanOrEqual": "6.1.*"
},
{
"status": "unaffected",
"version": "6.6.158",
"versionType": "semver",
"lessThanOrEqual": "6.6.*"
},
{
"status": "unaffected",
"version": "6.12.112",
"versionType": "semver",
"lessThanOrEqual": "6.12.*"
},
{
"status": "unaffected",
"version": "6.18.55",
"versionType": "semver",
"lessThanOrEqual": "6.18.*"
},
{
"status": "unaffected",
"version": "7.2.9",
"versionType": "semver",
"lessThanOrEqual": "7.2.*"
},
{
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix",
"lessThanOrEqual": "*"
}
],
"programFiles": [
"mm/backing-dev.c"
],
"defaultStatus": "affected"
}
]
}
],
"published": "2026-10-18T16:17:05.357",
"references": [
{
"url": "https://git.kernel.org/stable/c/260f586a80e7f624dd7f069898a75a904f34d373",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/407a5d205179a4ab186571b0e16ec42725dc77bc",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/42462b5bb0dec57db7f85d0f77655c737d45754d",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/4eb889649eaf65f4a5727b04ba1c017b7d05bb16",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/863049b4018237d1590cd13b16e9fe9c0faad2c6",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/ebf1555ad2821be06f87a88ffd9a2cab8d2200e1",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/fd3bf32279df98751364b3609eb100a3e42f253b",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}
],
"vulnStatus": "Received",
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwriteback: report a Tasks-RCU quiescent state per cgwb drain pass\n\ncleanup_offline_cgwbs_workfn() drains a dying cgwb by calling\ncleanup_offline_cgwb() until it returns false, with a cond_resched()\nbetween passes. On a CONFIG_PREEMPTION kernel that cond_resched() does\nnothing: _cond_resched() is a plain \"return 0\", and under PREEMPT_DYNAMIC\nthe full and lazy modes disable it. Since commit 7dadeaa6e851 (\"sched:\nFurther restrict the preemption modes\") those are the only two models on\nthe architectures with PREEMPT_LAZY support, arm64 and x86 among them, so\nthe drain loop never reports a Tasks-RCU quiescent state.\n\nA worker draining a cgwb with millions of attached inodes runs for\nminutes. On a 6.18 arm64 host in lazy mode the cgwb worker drained one\ndying cgroup's writeback domain for over 11 minutes. A BPF program unlink\n(bpf_trampoline_unlink_prog -> bpf_trampoline_update ->\nunregister_ftrace_direct -> ftrace_shutdown -> synchronize_rcu_tasks())\nwaited on that grace period while holding the trampoline mutex, 42 tasks\nqueued behind it in D state, and the hung task detector fired at 614 s and\npanicked the host. Any BPF or ftrace detach during a long drain inherits\nthe drain's length.\n\nFix this by calling cond_resched_tasks_rcu_qs() so we do not stall out\nanybody who calls sycnrhonize_rcu_tasks(). We put this in a do { } while\nloop because if we have many small cgroups cleanup_offline_cgwb() will\nreturn false and we will never call cond_resched_tasks_rcu_qs(), creating\nthe same problem."
}
],
"lastModified": "2026-10-19T10:19:09.220",
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}