{"id":"CVE-2026-98536","kind":"vulnerability","aliases":["CVE-2026-98536"],"related":[],"title":"Linux kernel: writeback drain loop can stall Tasks-RCU grace periods","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nwriteback: report a Tasks-RCU quiescent state per cgwb drain pass\n\ncleanup_offline_cgwbs_workfn() drains a dying cgwb by calling\ncleanup_offline_cgwb() until it returns false, with a cond_resched()\nbetween passes.  On a CONFIG_PREEMPTION kernel that cond_resched() does\nnothing: _cond_resched() is a plain \"return 0\", and under PREEMPT_DYNAMIC\nthe full and lazy modes disable it.  Since commit 7dadeaa6e851 (\"sched:\nFurther restrict the preemption modes\") those are the only two models on\nthe architectures with PREEMPT_LAZY support, arm64 and x86 among them, so\nthe drain loop never reports a Tasks-RCU quiescent state.\n\nA worker draining a cgwb with millions of attached inodes runs for\nminutes.  On a 6.18 arm64 host in lazy mode the cgwb worker drained one\ndying cgroup's writeback domain for over 11 minutes.  A BPF program unlink\n(bpf_trampoline_unlink_prog -> bpf_trampoline_update ->\nunregister_ftrace_direct -> ftrace_shutdown -> synchronize_rcu_tasks())\nwaited on that grace period while holding the trampoline mutex, 42 tasks\nqueued behind it in D state, and the hung task detector fired at 614 s and\npanicked the host.  Any BPF or ftrace detach during a long drain inherits\nthe drain's length.\n\nFix this by calling cond_resched_tasks_rcu_qs() so we do not stall out\nanybody who calls sycnrhonize_rcu_tasks().  We put this in a do { } while\nloop because if we have many small cgroups cleanup_offline_cgwb() will\nreturn false and we will never call cond_resched_tasks_rcu_qs(), creating\nthe same problem.","summary":"The writeback cleanup worker for dying cgroups can run for minutes without reporting a Tasks-RCU quiescent state, so callers waiting on that grace period (such as BPF or ftrace detach) can hang. A host can be hung-task panicked as a result, which is a denial of service rather than code execution.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["bpf","linux-kernel","other","self-hosted"],"not_affected_if":["default-config"],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-10-18T16:17:05+00:00","first_seen_at":"2026-10-23T21:57:15+00:00","triaged_at":"2026-10-25T05:23:47+00:00","updated_at":"2026-10-25T05:23:47+00:00","category":"other","confidence":0.5,"triage":{"at":"2026-10-25T05:23:47Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"Linux kernel: writeback drain loop can stall Tasks-RCU grace periods","impact":"low","summary":"The writeback cleanup worker for dying cgroups can run for minutes without reporting a Tasks-RCU quiescent state, so callers waiting on that grace period (such as BPF or ftrace detach) can hang. A host can be hung-task panicked as a result, which is a denial of service rather than code execution.","category":"other","nicknames":[],"who_cares":["linux-kernel","self-hosted","bpf"],"confidence":0.5,"needs_auth":"unknown","worst_case":"Kernel hangs and host panics via hung-task detector, causing denial of service","analyst_note":"Find the fixed kernel stable release and affected version ranges in the NVD entry or the kernel.org stable commit referenced by the CVE.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["default-config"],"who_is_affected":"The sources describe a Linux kernel fix in the writeback code, not a list of affected versions. Hosts running kernels with CONFIG_PREEMPTION and PREEMPT_DYNAMIC in full or lazy mode, with many attached inodes in dying cgroups, and BPF or ftrace detaches in use are the scenario described. unknown for exact versions.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000641,"input_tokens":3871,"output_tokens":507,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':14A,17A '-98536':15A,18A '0':143C '11':227C '42':258C '6.18':209C '614':273C '7dadeaa6e851':157C 'among':180C 'anybodi':308C 'architectur':172C 'arm64':177C,210C 'attach':202C 'behind':261C 'bpf':19B,55B,230C,233C,237C,280C 'call':113C,296C,310C,339C 'caller':47B 'cgroup':33B,221C,328C 'cgwb':101C,111C,116C,198C,216C,331C 'cgwbs':106C 'cleanup':29B,104C,114C,329C 'code':80B 'commit':156C 'cond':123C,133C,137C,297C,340C 'config':129C 'creat':345C 'cve':13A,16A 'd':264C 'denial':75B 'detach':58B,283C 'detector':270C 'die':32B,110C,220C 'direct':242C 'disabl':153C 'domain':224C 'drain':4A,102C,108C,184C,196C,218C,287C,290C 'dynam':147C 'execut':81B 'fals':120C,334C 'fire':271C 'fix':293C 'follow':87C 'ftrace':57B,241C,243C,282C 'full':149C 'grace':11A,51B,251C 'hang':60B 'hold':254C 'host':26B,62B,211C,278C 'hung':66B,268C 'hung-task':65B 'inherit':288C 'inod':203C 'kernel':2A,22B,85C,131C 'lazi':151C,175C,213C 'length':292C 'linux':1A,21B,84C 'linux-kernel':20B 'long':286C 'loop':5A,185C,321C 'mani':326C 'million':200C 'minut':37B,206C,228C 'mode':152C,163C,214C 'model':169C 'mutex':257C 'never':186C,338C 'noth':136C 'offlin':105C,115C,330C 'one':219C 'panick':68B,276C 'pass':103C,126C 'per':100C 'period':12A,52B,252C 'plain':141C 'preempt':146C,174C 'preemption':130C,162C 'problem':348C 'prog':236C 'program':231C 'put':315C 'qs':301C,344C 'queu':260C 'quiescent':44B,98C,192C 'rather':78B 'rcu':10A,43B,97C,191C,246C,300C,312C,343C 'report':39B,93C,187C 'resch':124C,134C,138C,298C,341C 'resolv':91C 'restrict':160C 'result':71B 'return':119C,142C,333C 'run':35B,204C 'sched':158C 'self':25B 'self-host':24B 'servic':77B 'shutdown':244C 'sinc':155C 'small':327C 'stall':7A,306C 'state':45B,99C,193C,265C 'support':176C 'sycnrhon':311C 'synchron':245C 'task':9A,42B,67B,96C,190C,247C,259C,269C,299C,313C,342C 'tasks-rcu':8A,41B,95C,189C 'trampolin':234C,238C,256C 'two':168C 'unlink':232C,235C 'unregist':240C 'updat':239C 'vulner':88C 'wait':48B,248C 'without':38B 'worker':30B,195C,217C 'workfn':107C 'writeback':3A,28B,92C,223C 'x86':179C","nicknames":[],"mitigations":[],"who_affected":"The sources describe a Linux kernel fix in the writeback code, not a list of affected versions. Hosts running kernels with CONFIG_PREEMPTION and PREEMPT_DYNAMIC in full or lazy mode, with many attached inodes in dying cgroups, and BPF or ftrace detaches in use are the scenario described. unknown for exact versions.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-18T16:17:05+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-98536","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-98536","severity":null,"published_at":"2026-10-18T16:17:05+00:00","modified_at":"2026-10-19T10:19:09+00:00","first_seen_at":"2026-10-23T21:57:15+00:00","fetched_at":"2026-10-23T22:28:56+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}