{"id":"CVE-2026-98542","kind":"vulnerability","aliases":["CVE-2026-98542"],"related":[],"title":"Linux kernel: cpuset remote partition can claim CPUs already owned by an ancestor","description":"In the Linux kernel, the following vulnerability has been resolved:\n\ncgroup/cpuset: Return PERR_NOCPUS in remote_partition_enable() on subpartitions_cpus conflict\n\nWhen a remote partition is created underneath an existing local partition\nvia a non-partition (PRS_MEMBER) intermediate cgroup, update_prstate() sees\nparent->partition_root_state == PRS_MEMBER and calls\nremote_partition_enable().\n\nCommit 86888c7bd117 (\"cgroup/cpuset: Add warnings to catch inconsistency\nin exclusive CPUs\") replaced the cpumask_intersects(tmp->new_cpus,\nsubpartitions_cpus) error check in remote_partition_enable() with\nWARN_ON_ONCE(). As a result, remote_partition_enable() emits a warning\nand proceeds to enable the remote partition on CPUs that are already\nowned by the ancestor local partition in subpartitions_cpus.\n\nThis can be reproduced on Linux 7.3.0-rc3 with:\n\n  mkdir -p /tmp/cg1\n  mount -t cgroup2 none /tmp/cg1\n  echo \"+cpuset\" > /tmp/cg1/cgroup.subtree_control\n\n  mkdir /tmp/cg1/A\n  echo 1 > /tmp/cg1/A/cpuset.cpus\n  echo 1 > /tmp/cg1/A/cpuset.cpus.exclusive\n  echo root > /tmp/cg1/A/cpuset.cpus.partition\n  echo \"+cpuset\" > /tmp/cg1/A/cgroup.subtree_control\n\n  mkdir /tmp/cg1/A/B\n  echo 1 > /tmp/cg1/A/B/cpuset.cpus\n  echo 1 > /tmp/cg1/A/B/cpuset.cpus.exclusive\n  echo \"+cpuset\" > /tmp/cg1/A/B/cgroup.subtree_control\n\n  mkdir /tmp/cg1/A/B/D\n  echo 1 > /tmp/cg1/A/B/D/cpuset.cpus\n  echo 1 > /tmp/cg1/A/B/D/cpuset.cpus.exclusive\n  echo root > /tmp/cg1/A/B/D/cpuset.cpus.partition\n\nwhich triggers:\n\n  WARNING: kernel/cgroup/cpuset.c:1594 at remote_partition_enable+0x1c1/0x300\n\nand leaves both /tmp/cg1/A and /tmp/cg1/A/B/D as active root partitions\nclaiming exclusive CPU 1.\n\nFix this by returning PERR_NOCPUS when tmp->new_cpus intersects\nsubpartitions_cpus in remote_partition_enable(), matching the error code\nused by remote_cpus_update() for the same subpartitions_cpus conflict, and\nadd a regression test case to\ntools/testing/selftests/cgroup/test_cpuset_prs.sh.\n\nTested in QEMU on Linux 7.3.0-rc3 using the reproducer above and\ntools/testing/selftests/cgroup/test_cpuset_prs.sh.","summary":"In the Linux cgroup cpuset controller, creating a remote partition under an existing local partition emits a warning and still enables the partition on CPUs the ancestor already owns, so two active root partitions claim the same exclusive CPU. The sources do not describe a direct way for an attacker to gain code execution or data access from this.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["cgroup-v2","containers","cpuset","kernel","kubernetes","linux","runtime"],"not_affected_if":["default-config","no-cpuset-partitions"],"how_to_check":"- Run `uname -r` and compare against the fixed kernel builds named in the sources (unknown)\n- Check whether cgroup v2 cpuset partitions are in use: `cat /sys/fs/cgroup/cgroup.subtree_control` and look for cpuset partition files such as `cpuset.cpus.partition` under nested cgroups","fix":"- Update the Linux kernel to a release that includes the upstream commit fixing cgroup/cpuset remote_partition_enable (version unknown from sources)","status":"open","published_at":"2026-10-18T16:17:06+00:00","first_seen_at":"2026-10-23T21:57:15+00:00","triaged_at":"2026-10-25T05:23:41+00:00","updated_at":"2026-10-25T05:23:41+00:00","category":"runtime","confidence":0.5,"triage":{"at":"2026-10-25T05:23:41Z","model":"claude-haiku-5-5","output":{"fix":"- Update the Linux kernel to a release that includes the upstream commit fixing cgroup/cpuset remote_partition_enable (version unknown from sources)","reach":"local","title":"Linux kernel: cpuset remote partition can claim CPUs already owned by an ancestor","impact":"low","summary":"In the Linux cgroup cpuset controller, creating a remote partition under an existing local partition emits a warning and still enables the partition on CPUs the ancestor already owns, so two active root partitions claim the same exclusive CPU. The sources do not describe a direct way for an attacker to gain code execution or data access from this.","category":"runtime","nicknames":[],"who_cares":["linux","kernel","cgroup-v2","cpuset","containers","kubernetes"],"confidence":0.5,"needs_auth":"yes","worst_case":"Exclusive CPU ownership is corrupted; no code execution is described","analyst_note":"Confirm affected kernel version range and the fixed release from the NVD entry and the upstream commit referenced in the description.","how_to_check":"- Run `uname -r` and compare against the fixed kernel builds named in the sources (unknown)\n- Check whether cgroup v2 cpuset partitions are in use: `cat /sys/fs/cgroup/cgroup.subtree_control` and look for cpuset partition files such as `cpuset.cpus.partition` under nested cgroups","needs_analyst":true,"not_affected_if":["default-config","no-cpuset-partitions"],"who_is_affected":"Systems running a Linux kernel with cgroup v2 cpuset partitions, where a non-partition intermediate cgroup sits between a local partition root and a nested remote partition. Systems that do not use cpuset partitions are unlikely to be affected. The sources do not say which kernel versions are vulnerable beyond the 7.3.0-rc3 reproducer.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"unknown"},"cost_usd":0.000772,"input_tokens":4295,"output_tokens":684,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'+0':267C '-2026':15A,18A '-98542':16A,19A '/tmp/cg1':213C,218C '/tmp/cg1/a':223C,272C '/tmp/cg1/a/b':237C '/tmp/cg1/a/b/cgroup.subtree_control':246C '/tmp/cg1/a/b/cpuset.cpus':240C '/tmp/cg1/a/b/cpuset.cpus.exclusive':243C '/tmp/cg1/a/b/d':248C,274C '/tmp/cg1/a/b/d/cpuset.cpus':251C '/tmp/cg1/a/b/d/cpuset.cpus.exclusive':254C '/tmp/cg1/a/b/d/cpuset.cpus.partition':257C '/tmp/cg1/a/cgroup.subtree_control':235C '/tmp/cg1/a/cpuset.cpus':226C '/tmp/cg1/a/cpuset.cpus.exclusive':229C '/tmp/cg1/a/cpuset.cpus.partition':232C '/tmp/cg1/cgroup.subtree_control':221C '1':225C,228C,239C,242C,250C,253C,282C '1594':262C '7.3.0':208C,328C '86888c7bd117':143C 'access':85B 'activ':60B,276C 'add':145C,316C 'alreadi':9A,56B,192C 'ancestor':13A,55B,196C 'attack':78B 'call':138C 'case':320C 'catch':148C 'cgroup':21B,32B,127C 'cgroup-v2':20B 'cgroup/cpuset':96C,144C 'cgroup2':216C 'check':163C 'claim':7A,63B,279C 'code':81B,303C 'commit':142C 'conflict':107C,314C 'contain':23B 'control':34B 'cpu':67B,281C 'cpumask':155C 'cpus':8A,53B,106C,152C,159C,161C,189C,201C,292C,295C,307C,313C 'cpuset':3A,24B,33B,220C,234C,245C 'creat':35B,113C 'cve':14A,17A 'data':84B 'describ':72B 'direct':74B 'echo':219C,224C,227C,230C,233C,238C,241C,244C,249C,252C,255C 'emit':44B,178C 'enabl':49B,103C,141C,167C,177C,184C,266C,299C 'error':162C,302C 'exclus':66B,151C,280C 'execut':82B 'exist':41B,116C 'fix':283C 'follow':91C 'gain':80B 'inconsist':149C 'intermedi':126C 'intersect':156C,293C 'kernel':2A,25B,89C 'kernel/cgroup/cpuset.c':261C 'kubernet':26B 'leav':270C 'linux':1A,27B,31B,88C,207C,327C 'local':42B,117C,197C 'match':300C 'member':125C,136C 'mkdir':211C,222C,236C,247C 'mount':214C 'new':158C,291C 'nocpus':99C,288C 'non':122C 'non-partit':121C 'none':217C 'own':10A,57B,193C 'p':212C 'parent':131C 'partit':5A,38B,43B,51B,62B,102C,111C,118C,123C,132C,140C,166C,176C,187C,198C,265C,278C,298C 'perr':98C,287C 'proceed':182C 'prs':124C,135C 'prstate':129C 'qemu':325C 'rc3':209C,329C 'regress':318C 'remot':4A,37B,101C,110C,139C,165C,175C,186C,264C,297C,306C 'replac':153C 'reproduc':205C,332C 'resolv':95C 'result':174C 'return':97C,286C 'root':61B,133C,231C,256C,277C 'runtim':28B 'see':130C 'sourc':69B 'state':134C 'still':48B 'subpartit':105C,160C,200C,294C,312C 'test':319C,323C 'tmp':157C,290C 'tools/testing/selftests/cgroup/test_cpuset_prs.sh':322C,335C 'trigger':259C 'two':59B 'underneath':114C 'updat':128C,308C 'use':304C,330C 'v2':22B 'via':119C 'vulner':92C 'warn':46B,146C,169C,180C,260C 'way':75B 'x1c1/0x300':268C","nicknames":[],"mitigations":[],"who_affected":"Systems running a Linux kernel with cgroup v2 cpuset partitions, where a non-partition intermediate cgroup sits between a local partition root and a nested remote partition. Systems that do not use cpuset partitions are unlikely to be affected. The sources do not say which kernel versions are vulnerable beyond the 7.3.0-rc3 reproducer.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-18T16:17:06+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-98542","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-98542","severity":null,"published_at":"2026-10-18T16:17:06+00:00","modified_at":"2026-10-19T10:19:10+00:00","first_seen_at":"2026-10-23T21:57:15+00:00","fetched_at":"2026-10-23T22:28:56+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}