{
  "threat_severity" : "Important",
  "public_date" : "2026-06-24T00:00:00Z",
  "bugzilla" : {
    "description" : "kernel: sched/psi: fix race between file release and pressure write",
    "id" : "2492403",
    "url" : "https://bugzilla.redhat.com/show_bug.cgi?id=2492403"
  },
  "cvss3" : {
    "cvss3_base_score" : "7.0",
    "cvss3_scoring_vector" : "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
    "status" : "verified"
  },
  "cwe" : "CWE-367",
  "details" : [ "In the Linux kernel, the following vulnerability has been resolved:\nsched/psi: fix race between file release and pressure write\nA potential race condition exists between pressure write and cgroup file\nrelease regarding the priv member of struct kernfs_open_file, which\ntriggers the uaf reported in [1].\nConsider the following scenario involving execution on two separate CPUs:\nCPU0CPU1\n========\nvfs_rmdir()\nkernfs_iop_rmdir()\ncgroup_rmdir()\ncgroup_kn_lock_live()\ncgroup_destroy_locked()\ncgroup_addrm_files()\ncgroup_rm_file()\nkernfs_remove_by_name()\nkernfs_remove_by_name_ns()\nvfs_write()__kernfs_remove()\nnew_sync_write()kernfs_drain()\nkernfs_fop_write_iter()kernfs_drain_open_files()\ncgroup_file_write()kernfs_release_file()\npressure_write()cgroup_file_release()\nctx = of->priv;\nkfree(ctx);\nof->priv = NULL;\ncgroup_kn_unlock()\ncgroup_kn_lock_live()\ncgroup_get(cgrp)\ncgroup_kn_unlock()\nif (ctx->psi.trigger)  // here, trigger uaf for ctx, that is of->priv\nThe cgroup_rmdir() is protected by the cgroup_mutex, it also safeguards\nthe memory deallocation of of->priv performed within cgroup_file_release().\nHowever, the operations involving of->priv executed within pressure_write()\nare not entirely covered by the protection of cgroup_mutex. Consequently,\nif the code in pressure_write(), specifically the section handling the\nctx variable executes after cgroup_file_release() has completed, a uaf\nvulnerability involving of->priv is triggered.\nTherefore, the issue can be resolved by extending the scope of the\ncgroup_mutex lock within pressure_write() to encompass all code paths\ninvolving of->priv, thereby properly synchronizing the race condition\noccurring between cgroup_file_release() and pressure_write().\nAnd, if an live kn lock can be successfully acquired while executing\nthe pressure write operation, it indicates that the cgroup deletion\nprocess has not yet reached its final stage; consequently, the priv\npointer within open_file cannot be NULL. Therefore, the operation to\nretrieve the ctx value must be moved to a point *after* the live kn\nlock has been successfully acquired.\nIn another situation, specifically after entering cgroup_kn_lock_live()\nbut before acquiring cgroup_mutex, there exists a different class of\nrace condition:\nCPU0: write memory.pressure               CPU1: write cgroup.pressure=0\n===========================  =============================\nkernfs_fop_write_iter()\nkernfs_get_active_of(of)\npressure_write()\ncgroup_kn_lock_live(memory.pressure)\ncgroup_tryget(cgrp)\nkernfs_break_active_protection(kn)\n... blocks on cgroup_mutex\ncgroup_pressure_write()\ncgroup_kn_lock_live(cgroup.pressure)\ncgroup_file_show(memory.pressure, false)\nkernfs_show(false)\nkernfs_drain_open_files()\ncgroup_file_release(of)\nkfree(ctx)\nof->priv = NULL\ncgroup_kn_unlock()\n... acquires cgroup_mutex\nctx = of->priv;        // may now be NULL\nif (ctx->psi.trigger)  // NULL dereference\nConsequently, there is a possibility that of->priv is NULL, the pressure\nwrite needs to check for this.\nNow that the scope of the cgroup_mutex has been expanded, the original\nexplicit cgroup_get/put operations are no longer necessary, this is\nbecause acquiring/releasing the live kn lock inherently executes a\ncgroup get/put operation.\n[1]\nBUG: KASAN: slab-use-after-free in pressure_write+0xa4/0x210 kernel/cgroup/cgroup.c:4011\nCall Trace:\npressure_write+0xa4/0x210 kernel/cgroup/cgroup.c:4011\ncgroup_file_write+0x36f/0x790 kernel/cgroup/cgroup.c:43\n---truncated---", "A flaw was found in the Linux kernel's Pressure Stall Information (PSI) subsystem. A race condition exists between the file release and pressure write operations, specifically concerning the `priv` member of `struct kernfs_open_file`. This can lead to a use-after-free vulnerability or a NULL dereference, potentially causing system instability or a denial of service. The issue arises when the `priv` member is deallocated during a cgroup file release while a pressure write operation attempts to access it, or when it becomes NULL before being accessed." ],
  "affected_release" : [ {
    "product_name" : "Red Hat Enterprise Linux 10",
    "release_date" : "2026-08-20T00:00:00Z",
    "advisory" : "RHSA-2026:57251",
    "cpe" : "cpe:/o:redhat:enterprise_linux:10.2",
    "package" : "kernel-0:6.12.0-211.49.1.el10_2"
  }, {
    "product_name" : "Red Hat Enterprise Linux 8",
    "release_date" : "2026-08-20T00:00:00Z",
    "advisory" : "RHSA-2026:57254",
    "cpe" : "cpe:/a:redhat:enterprise_linux:8::nfv",
    "package" : "kernel-rt-0:4.18.0-553.157.1.rt7.498.el8_10"
  }, {
    "product_name" : "Red Hat Enterprise Linux 8",
    "release_date" : "2026-08-20T00:00:00Z",
    "advisory" : "RHSA-2026:57253",
    "cpe" : "cpe:/o:redhat:enterprise_linux:8",
    "package" : "kernel-0:4.18.0-553.157.1.el8_10"
  }, {
    "product_name" : "Red Hat Enterprise Linux 9",
    "release_date" : "2026-08-20T00:00:00Z",
    "advisory" : "RHSA-2026:57252",
    "cpe" : "cpe:/a:redhat:enterprise_linux:9",
    "package" : "kernel-0:5.14.0-687.41.1.el9_8"
  }, {
    "product_name" : "Red Hat Enterprise Linux 9",
    "release_date" : "2026-08-20T00:00:00Z",
    "advisory" : "RHSA-2026:57252",
    "cpe" : "cpe:/o:redhat:enterprise_linux:9",
    "package" : "kernel-0:5.14.0-687.41.1.el9_8"
  } ],
  "package_state" : [ {
    "product_name" : "Red Hat Enterprise Linux 6",
    "fix_state" : "Not affected",
    "package_name" : "kernel",
    "cpe" : "cpe:/o:redhat:enterprise_linux:6"
  }, {
    "product_name" : "Red Hat Enterprise Linux 7",
    "fix_state" : "Not affected",
    "package_name" : "kernel",
    "cpe" : "cpe:/o:redhat:enterprise_linux:7"
  }, {
    "product_name" : "Red Hat Enterprise Linux 7",
    "fix_state" : "Not affected",
    "package_name" : "kernel-rt",
    "cpe" : "cpe:/o:redhat:enterprise_linux:7"
  }, {
    "product_name" : "Red Hat Enterprise Linux 9",
    "fix_state" : "Affected",
    "package_name" : "kernel-rt",
    "cpe" : "cpe:/o:redhat:enterprise_linux:9"
  } ],
  "references" : [ "https://www.cve.org/CVERecord?id=CVE-2026-52991\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-52991\nhttps://lore.kernel.org/linux-cve-announce/2026062444-CVE-2026-52991-18fe@gregkh/T" ],
  "name" : "CVE-2026-52991",
  "csaw" : false
}