CVE-2026-43439: Linux Kernel Race Condition Vulnerability

CVE-2026-43439 Overview

CVE-2026-43439 is a race condition in the Linux kernel's control group (cgroup) subsystem. The flaw exists between task migration and iteration over a css_set. When cgroup_migrate_add_task() moves a task from cset->tasks to cset->mg_tasks, an active css_task_iter can advance against the wrong list. Iteration then skips remaining tasks on cset->tasks and tasks queued on cset->mg_tasks. The result is inconsistent cgroup membership reporting through interfaces such as cgroup.procs. The bug has been resolved upstream and backported across multiple stable kernel branches.

Critical Impact
Concurrent reads of cgroup.procs during task migration can intermittently omit PIDs, producing incorrect process enumeration that may impact monitoring, container orchestration, and security tooling that relies on cgroup membership data.

Affected Products

Linux kernel (mainline)
Linux kernel stable branches receiving the backported fix
Distributions and downstream kernels packaging affected versions

Discovery Timeline

2026-05-08 - CVE-2026-43439 published to NVD
2026-05-12 - Last updated in NVD database

Technical Details for CVE-2026-43439

Vulnerability Analysis

The vulnerability lives in the cgroup task migration path. When a task is migrated out of a css_set, cgroup_migrate_add_task() first relocates it from cset->tasks to cset->mg_tasks using list_move_tail(&task->cg_list, &cset->mg_tasks). If an active css_task_iter has it->task_pos pointing at the migrating task, css_set_move_task() calls css_task_iter_skip() to keep the iterator valid.

The defect is that by the time css_task_iter_skip() runs, the task has already moved onto the mg_tasks list. The iterator therefore advances relative to mg_tasks rather than the original tasks list. Remaining tasks on cset->tasks, and tasks already queued on cset->mg_tasks, can be silently skipped during iteration. This classifies as a race condition affecting kernel data-structure consistency [CWE-362].

Root Cause

The root cause is the ordering of operations in cgroup_migrate_add_task(). The function unlinks task->cg_list from cset->tasks before advancing iterators that point at the task. Because the iterator skip routine consults the list the task currently resides on, it operates on the wrong list and the iterator state becomes inconsistent with the source list.

The upstream fix invokes css_set_skip_task_iters() before unlinking task->cg_list from cset->tasks. This advances all active iterators to the next task on cset->tasks while the list relationship is still correct, preserving iteration semantics during concurrent migration.

Attack Vector

The issue is not a remote or memory-corruption flaw. It is a local correctness bug triggered by concurrent activity. Reproduction requires spawning long-running tasks, placing them in a test cgroup, then reading cgroup.procs while another writer migrates a PID into a different cgroup. With an artificial delay in cgroup_procs_show(), the reader observes a subset of PIDs that omits both pre-migration and post-migration entries. Without instrumentation the race window is small, but it is reachable on production systems under load.

No verified exploitation code is published. The vulnerability mechanism is described in prose because no realCodeExamples were provided. The upstream commits referenced in the Linux kernel stable tree document the fix in full.

Detection Methods for CVE-2026-43439

Indicators of Compromise

Intermittent discrepancies between cgroup.procs reads and the actual set of processes assigned to a cgroup during concurrent migration.
Monitoring or orchestration agents reporting missing PIDs that reappear on subsequent reads after migration completes.
Container runtimes or schedulers logging inconsistent task accounting tied to migration events.

Detection Strategies

Verify the running kernel version against the fixed commits listed in the kernel.org stable tree references for each affected branch.
Compare process enumeration from /proc with cgroup.procs output across repeated samples during cgroup migration events to surface anomalies.
Audit telemetry pipelines that depend on cgroup membership for completeness validation.

Monitoring Recommendations

Track kernel package updates across the fleet and flag hosts running pre-patch builds.
Instrument container orchestrators and host agents to log cgroup migration events alongside membership snapshots.
Correlate observed process enumeration anomalies with cgroup write activity in audit logs.

How to Mitigate CVE-2026-43439

Immediate Actions Required

Identify systems running Linux kernels predating the backported fix in their stable branch.
Schedule kernel upgrades to versions containing the patch referenced by the upstream commits.
Validate that container, Kubernetes, and systemd workloads continue to function on the updated kernel.

Patch Information

The fix has been merged upstream and backported across multiple stable branches. The relevant commits are published in the kernel.org stable repository, including commit 3b95abab7369, commit 3dfd1328c052, commit 4a9654a2b46c, commit 5ee01f1a7343, commit 7c85debc35e6, commit 86ceaccfdfa1, commit 9cca530c7cc1, and commit 9dc76f6fc0d2. Apply the vendor kernel update that incorporates these commits for your distribution.

Workarounds

No reliable userspace workaround exists; the race lives entirely inside the kernel cgroup core.
Reduce the frequency of concurrent cgroup.procs reads during active task migration as a partial operational mitigation.
Where feasible, serialize cgroup migration operations through a single orchestrator to limit exposure until the patch is deployed.

bash

# Verify kernel version and confirm the cgroup fix is present
uname -r
# Then check your distribution advisory for the version that includes
# commit 3b95abab7369 ("cgroup: fix race between task migration and iteration")