CVE-2026-74594: Linux Kernel Race Condition Vulnerability

CVE-2026-74594 Overview

CVE-2026-74594 is a use-after-free vulnerability in the Linux kernel's Pressure Stall Information (PSI) subsystem. The flaw resides in the sched/psi code path, where psi_schedule_rtpoll_work() races against psi_trigger_destroy() when the last real-time poll trigger is torn down. The rtpoll_timer can be re-armed after the underlying PSI group is freed, causing poll_timer_fn() to execute on freed memory.

Exploitation requires local access with the ability to create and destroy PSI triggers on cgroups. Successful exploitation can lead to kernel memory corruption, denial of service, or local privilege escalation.

Critical Impact
A local attacker with cgroup PSI trigger access can trigger use-after-free of kernel memory, potentially achieving privilege escalation on affected Linux systems.

Affected Products

Linux kernel versions containing commit 461daba06bdc ("psi: eliminate kthread_worker from psi trigger scheduling mechanism") and later versions prior to the fix
Linux kernel versions containing commit 8f91efd870ea ("psi: Fix race between psi_trigger_create/destroy")
Distributions shipping unpatched stable kernels using PSI cgroup triggers

Discovery Timeline

2026-08-22 - CVE-2026-74594 published to NVD
2026-08-25 - Last updated in NVD database

Technical Details for CVE-2026-74594

Vulnerability Analysis

The vulnerability is a race condition in the PSI subsystem's real-time polling infrastructure. psi_schedule_rtpoll_work() is invoked locklessly from the scheduler hot path. It uses Read-Copy-Update (RCU) to dereference rtpoll_task and then calls mod_timer() on rtpoll_timer.

Concurrently, psi_trigger_destroy() can tear down the last real-time poll trigger under rtpoll_trigger_lock. The destroy path clears rtpoll_task, deletes the timer, waits for an RCU grace period, and stops the kthread. If the scheduler path observes the task pointer before it is cleared, it can re-arm rtpoll_timer after timer_delete() has run. The PSI group is then freed while the timer remains pending, and poll_timer_fn() runs on freed memory.

Root Cause

The root cause is improper lifetime management of rtpoll_timer relative to the PSI cgroup. Prior fixes moved the timer teardown between the RCU synchronization point and the destroy lock, but no placement in the destruction path is safe. The lockless scheduler caller cannot be prevented from arming the timer after it is deleted, creating a window where the timer outlives the group memory it references.

Attack Vector

An attacker with local unprivileged access capable of creating and destroying PSI triggers on cgroups can race the scheduler hot path against trigger destruction. Repeated cgroup churn combined with scheduler pressure triggers psi_schedule_rtpoll_work() frequently enough to observe the race. Successful exploitation yields kernel memory corruption through poll_timer_fn() executing against a freed psi_group structure. The fix binds the timer lifetime to the group and shuts it down in psi_cgroup_free() using timer_shutdown_sync(), ensuring nothing can arm the timer after group teardown.

No public proof-of-concept is available. The vulnerability is described in the upstream commit messages referenced below.

Detection Methods for CVE-2026-74594

Indicators of Compromise

Kernel oops or panic messages referencing poll_timer_fn, psi_schedule_rtpoll_work, or mod_timer on freed slab objects
KASAN reports flagging use-after-free in the kernel/sched/psi.c code path
Unexpected process crashes or scheduler stalls correlated with intensive cgroup create/destroy activity

Detection Strategies

Enable Kernel Address Sanitizer (KASAN) in test environments to catch use-after-free access in PSI code paths
Monitor dmesg and kernel crash dumps for stack traces containing psi_trigger_destroy, rtpoll_timer, or psi_cgroup_free
Audit cgroup PSI trigger usage patterns to identify workloads or containers repeatedly creating and destroying PSI triggers

Monitoring Recommendations

Track kernel version inventory across the fleet and flag hosts running unpatched stable kernels
Alert on unexplained kernel panics or soft lockups on multi-tenant Linux hosts and container orchestration nodes
Correlate scheduler subsystem crashes with local user activity to identify potential exploitation attempts

How to Mitigate CVE-2026-74594

Immediate Actions Required

Apply the vendor-supplied stable kernel update that shuts down rtpoll_timer inside psi_cgroup_free() using timer_shutdown_sync()
Prioritize patching of multi-tenant hosts, container platforms, and shared Kubernetes nodes where untrusted local workloads run
Restrict unprivileged access to cgroup PSI interfaces on systems that cannot be immediately patched

Patch Information

The upstream fix binds rtpoll_timer to the PSI group's lifetime and shuts it down in psi_cgroup_free(), since nothing can arm the timer after that point. Refer to the following stable tree commits: Kernel Git Commit 1e5ca82e, Kernel Git Commit 310b5a53, Kernel Git Commit 4addb102, Kernel Git Commit 5457025f, Kernel Git Commit 611e7821, Kernel Git Commit 8037c5b2, Kernel Git Commit 806fcff9, and Kernel Git Commit 894a9300.

Workarounds

Disable PSI trigger creation for unprivileged users by tightening permissions on /proc/pressure/* and cgroup PSI files
Where feasible, disable CONFIG_PSI or set psi=0 on the kernel command line to remove the vulnerable code path
Limit local shell access on shared Linux hosts until the patched kernel is deployed

bash

# Verify kernel version and PSI configuration
uname -r
grep CONFIG_PSI /boot/config-$(uname -r)

# Restrict access to cgroup PSI trigger files (example)
find /sys/fs/cgroup -name 'cpu.pressure' -o -name 'memory.pressure' -o -name 'io.pressure' \
  -exec chmod 0400 {} \;

# Optionally disable PSI at boot by appending to kernel cmdline
# psi=0