{"id":"CVE-2026-98972","kind":"vulnerability","aliases":["CVE-2026-98972"],"related":[],"title":"Linux kernel: cpuset v2 mode check may read a stale cgroup pointer","description":"In the Linux kernel, the following vulnerability has been resolved:\n\ncgroup/cpuset: Don't access cpuset_cgrp_subsys.root in is_in_v2_mode()\n\nAfter seeing the patch [1] to guard is_in_v2_mode() with RCU, it makes\nme realize that is_in_v2_mode() may be called in a context where a new\ncgroup filesystem is being rebound with stale cpuset_cgrp_subsys.root\npointer. Avoid this potential UaF situation by adding a new cpuset_v2_mode\nflag which is set when the cpuset_v2_mode mount option is used. This\nflag is written into only when cpuset_bind() is being called with a\nstable cpuset_cgrp_subsys.root value. The is_in_v2_mode() helper is\nmodified to read the new cpuset_v2_mode flag instead of accessing\ncpuset_cgrp_subsys.root directly.\n\n[1] https://lore.kernel.org/lkml/20260929084124.626693-2-arighi@nvidia.com","summary":"In the Linux kernel cpuset controller, the is_in_v2_mode() helper could read a cgroup root pointer that is stale while a cgroup filesystem is being rebound. The fix replaces that read with a dedicated cpuset_v2_mode flag, which avoids a potential use-after-free; the sources do not state a direct attacker outcome.","severity":"unknown","cvss":null,"epss":0.00198,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["containers","infrastructure","linux-kernel","self-hosted"],"not_affected_if":[],"how_to_check":"- unknown","fix":"- Update the Linux kernel to a release that includes the upstream commit resolving CVE-2026-98972 (cgroup/cpuset: Don't access cpuset_cgrp_subsys.root in is_in_v2_mode()); the fixed version numbers are not given in the sources.","status":"open","published_at":"2026-10-23T13:17:18+00:00","first_seen_at":"2026-10-23T21:57:33+00:00","triaged_at":"2026-10-25T04:56:25+00:00","updated_at":"2026-10-25T12:38:50+00:00","category":"infrastructure","confidence":0.3,"triage":{"at":"2026-10-25T04:56:25Z","model":"claude-haiku-5-5","output":{"fix":"- Update the Linux kernel to a release that includes the upstream commit resolving CVE-2026-98972 (cgroup/cpuset: Don't access cpuset_cgrp_subsys.root in is_in_v2_mode()); the fixed version numbers are not given in the sources.","reach":"unknown","title":"Linux kernel: cpuset v2 mode check may read a stale cgroup pointer","impact":"medium","summary":"In the Linux kernel cpuset controller, the is_in_v2_mode() helper could read a cgroup root pointer that is stale while a cgroup filesystem is being rebound. The fix replaces that read with a dedicated cpuset_v2_mode flag, which avoids a potential use-after-free; the sources do not state a direct attacker outcome.","category":"infrastructure","nicknames":[],"who_cares":["linux-kernel","self-hosted","containers"],"confidence":0.3,"needs_auth":"unknown","worst_case":"unknown; sources describe a potential use-after-free","analyst_note":"Find the upstream kernel commit and affected/fixed version ranges, and whether the cgroup rebind race is reachable by unprivileged users; check the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-98972.","how_to_check":"- unknown","needs_analyst":true,"not_affected_if":[],"who_is_affected":"Systems running a Linux kernel with the cpuset cgroup controller and the cpuset_v2_mode mount option path are the ones the fix concerns. The sources do not say which kernel versions are vulnerable or how an attacker would trigger the stale pointer, so teams can not yet confirm who can skip it.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000669,"input_tokens":3556,"output_tokens":626,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':14A,17A '-98972':15A,18A '/lkml/20260929084124.626693-2-arighi@nvidia.com':210C '1':108C,207C 'access':97C,204C 'add':150C 'attack':82B 'avoid':68B,144C 'bind':177C 'call':128C,180C 'cgroup':11A,42B,50B,135C 'cgroup/cpuset':94C 'check':6A 'contain':19B 'context':131C 'control':32B 'could':39B 'cpuset':3A,31B,63B,153C,162C,176C,198C 'cpuset_cgrp_subsys.root':98C,142C,184C,205C 'cve':13A,16A 'dedic':62B 'direct':81B,206C 'filesystem':51B,136C 'fix':56B 'flag':66B,156C,170C,201C 'follow':89C 'free':74B 'guard':110C 'helper':38B,191C 'host':26B 'infrastructur':20B 'instead':202C 'kernel':2A,23B,30B,87C 'linux':1A,22B,29B,86C 'linux-kernel':21B 'lore.kernel.org':209C 'lore.kernel.org/lkml/20260929084124.626693-2-arighi@nvidia.com':208C 'make':118C 'may':7A,126C 'mode':5A,37B,65B,103C,114C,125C,155C,164C,190C,200C 'modifi':193C 'mount':165C 'new':134C,152C,197C 'option':166C 'outcom':83B 'patch':107C 'pointer':12A,44B,143C 'potenti':70B,146C 'rcu':116C 'read':8A,40B,59B,195C 'realiz':120C 'rebound':54B,139C 'replac':57B 'resolv':93C 'root':43B 'see':105C 'self':25B 'self-host':24B 'set':159C 'situat':148C 'sourc':76B 'stabl':183C 'stale':10A,47B,141C 'state':79B 'uaf':147C 'use':72B,168C 'use-after-fre':71B 'v2':4A,36B,64B,102C,113C,124C,154C,163C,189C,199C 'valu':185C 'vulner':90C 'written':172C","nicknames":[],"mitigations":[],"who_affected":"Systems running a Linux kernel with the cpuset cgroup controller and the cpuset_v2_mode mount option path are the ones the fix concerns. The sources do not say which kernel versions are vulnerable or how an attacker would trigger the stale pointer, so teams can not yet confirm who can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-23T13:17:18+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-98972","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-98972","severity":null,"published_at":"2026-10-23T13:17:18+00:00","modified_at":"2026-10-23T13:17:18+00:00","first_seen_at":"2026-10-23T21:57:33+00:00","fetched_at":"2026-10-23T22:29:03+00:00","note":null},{"source":"epss","external_id":"CVE-2026-98972","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-98972","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-25T12:38:50+00:00","fetched_at":"2026-10-25T12:38:50+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}