CVE-2026-52991 Overview
CVE-2026-52991 is a use-after-free vulnerability in the Linux kernel's Pressure Stall Information (PSI) subsystem. The flaw arises from a race condition between pressure_write() and cgroup_file_release() operations on the priv member of struct kernfs_open_file. When a cgroup file is released concurrently with a pressure write operation, the ctx pointer obtained from of->priv can reference memory that has already been freed.
The race involves two distinct scenarios: a classic use-after-free when kfree(ctx) completes before pressure_write() dereferences the pointer, and a NULL pointer dereference when of->priv is cleared after cgroup_kn_lock_live() acquisition. Both paths can lead to kernel memory corruption or crash.
Critical Impact
Local unprivileged users can trigger a use-after-free in kernel memory through concurrent writes to cgroup pressure files, potentially leading to kernel crash or privilege escalation.
Affected Products
- Linux kernel (mainline) — kernel/cgroup/cgroup.c PSI write path
- Linux kernel stable branches prior to the fix commits
- Distributions shipping kernels with CONFIG_PSI enabled and cgroup v2 pressure interfaces
Discovery Timeline
- 2026-06-24 - CVE CVE-2026-52991 published to NVD
- 2026-06-24 - Last updated in NVD database
Technical Details for CVE-2026-52991
Vulnerability Analysis
The vulnerability resides in the pressure_write() function in kernel/cgroup/cgroup.c. The PSI pressure interface allows userspace to write threshold configurations to cgroup files such as memory.pressure, cpu.pressure, and io.pressure. The handler retrieves a context structure through ctx = of->priv and subsequently accesses ctx->psi.trigger.
When the cgroup is removed via vfs_rmdir(), the kernel invokes cgroup_destroy_locked() which eventually calls cgroup_file_release(). This release path frees the context with kfree(ctx) and sets of->priv = NULL. The cgroup_mutex protects the deallocation, but the original pressure_write() implementation read of->priv outside the mutex scope.
A second race exists after cgroup_kn_lock_live() is entered but before cgroup_mutex is acquired. A concurrent write to cgroup.pressure=0 can trigger kernfs_show(false), which drains open files and frees the context. When the blocked writer finally acquires cgroup_mutex, of->priv is NULL, causing a NULL pointer dereference at ctx->psi.trigger.
Root Cause
The root cause is insufficient locking scope around accesses to of->priv in pressure_write(). The cgroup_mutex protected the deallocation in cgroup_file_release() but did not cover the read of of->priv in the write path, creating a time-of-check to time-of-use [TOCTOU] window.
Attack Vector
A local attacker with write access to cgroup PSI files can race a concurrent rmdir() of the cgroup or a write to cgroup.pressure to trigger the freed-memory access. The KASAN report cited in the upstream commit confirms reachability via the standard vfs_write() → kernfs_fop_write_iter() → cgroup_file_write() → pressure_write() call chain.
The vulnerability requires concurrent execution on separate CPUs and precise timing. No remote vector exists; exploitation requires local code execution and access to cgroup file system mount points.
Detection Methods for CVE-2026-52991
Indicators of Compromise
- KASAN reports referencing slab-use-after-free in pressure_write in kernel logs
- Unexpected kernel oops or NULL pointer dereferences with pressure_write in the call trace
- Kernel panics correlated with cgroup directory removal operations on hosts running container workloads
Detection Strategies
- Monitor dmesg and /var/log/kern.log for KASAN slab-use-after-free entries referencing kernel/cgroup/cgroup.c
- Audit kernel versions across the fleet against the fixed commit hashes 03dc070fa0fc, a5b98009f16d, and d4352c0709bf
- Correlate process telemetry showing concurrent cgroup rmdir operations and writes to *.pressure files from unprivileged users
Monitoring Recommendations
- Enable kernel crash collection and forward oops messages to a centralized log platform for analysis
- Track auditd events for writes to /sys/fs/cgroup/**/memory.pressure, cpu.pressure, and io.pressure
- Alert on processes that rapidly create and destroy cgroups while concurrently writing PSI thresholds
How to Mitigate CVE-2026-52991
Immediate Actions Required
- Apply the upstream stable kernel patches referenced by commits 03dc070fa0fc3cb4068693f468ccd5f8a7e58282, a5b98009f16d8a5fb4a8ff9a193f5735515c38fa, and d4352c0709bfd38c752fccbde7fd72a82ac78f23
- Inventory all Linux hosts with CONFIG_PSI=y and cgroup v2 enabled to scope the affected fleet
- Restrict write access to cgroup PSI interfaces to trusted system components only
Patch Information
The fix extends the scope of cgroup_mutex in pressure_write() to cover all accesses to of->priv, eliminating both the use-after-free and the NULL pointer dereference races. The ctx retrieval is moved to after the live kn lock is acquired, and a NULL check is added. See the first stable commit, second stable commit, and third stable commit for the upstream fix.
Workarounds
- Restrict mount permissions on cgroup v2 hierarchies to prevent unprivileged user access to pressure files
- Disable PSI by booting with psi=0 on systems that do not require pressure stall accounting
- Apply SELinux or AppArmor policies that block write access to *.pressure files for non-administrative processes
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
