{
  "affected": [
    {
      "ranges": [
        {
          "events": [
            {
              "introduced": "86888c7bd117c29eab169c37e5f6bbbf583da983"
            },
            {
              "fixed": "241e67b60308cdce25bba66616a109759edd1d40"
            },
            {
              "fixed": "0751ab665cb3dcdac224b002565f2e28461740d5"
            },
            {
              "fixed": "31c88350b7dd1522792f726f79607f31bb55c50f"
            }
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "type": "GIT"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Linux",
        "name": "Kernel"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "6.16.0"
            },
            {
              "fixed": "6.18.55"
            }
          ],
          "type": "ECOSYSTEM"
        },
        {
          "events": [
            {
              "introduced": "6.19.0"
            },
            {
              "fixed": "7.2.9"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "database_specific": {
    "cna_assigner": "Linux",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/98xxx/CVE-2026-98542.json"
  },
  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\ncgroup/cpuset: Return PERR_NOCPUS in remote_partition_enable() on subpartitions_cpus conflict\n\nWhen a remote partition is created underneath an existing local partition\nvia a non-partition (PRS_MEMBER) intermediate cgroup, update_prstate() sees\nparent-\u003epartition_root_state == PRS_MEMBER and calls\nremote_partition_enable().\n\nCommit 86888c7bd117 (\"cgroup/cpuset: Add warnings to catch inconsistency\nin exclusive CPUs\") replaced the cpumask_intersects(tmp-\u003enew_cpus,\nsubpartitions_cpus) error check in remote_partition_enable() with\nWARN_ON_ONCE(). As a result, remote_partition_enable() emits a warning\nand proceeds to enable the remote partition on CPUs that are already\nowned by the ancestor local partition in subpartitions_cpus.\n\nThis can be reproduced on Linux 7.3.0-rc3 with:\n\n  mkdir -p /tmp/cg1\n  mount -t cgroup2 none /tmp/cg1\n  echo \"+cpuset\" \u003e /tmp/cg1/cgroup.subtree_control\n\n  mkdir /tmp/cg1/A\n  echo 1 \u003e /tmp/cg1/A/cpuset.cpus\n  echo 1 \u003e /tmp/cg1/A/cpuset.cpus.exclusive\n  echo root \u003e /tmp/cg1/A/cpuset.cpus.partition\n  echo \"+cpuset\" \u003e /tmp/cg1/A/cgroup.subtree_control\n\n  mkdir /tmp/cg1/A/B\n  echo 1 \u003e /tmp/cg1/A/B/cpuset.cpus\n  echo 1 \u003e /tmp/cg1/A/B/cpuset.cpus.exclusive\n  echo \"+cpuset\" \u003e /tmp/cg1/A/B/cgroup.subtree_control\n\n  mkdir /tmp/cg1/A/B/D\n  echo 1 \u003e /tmp/cg1/A/B/D/cpuset.cpus\n  echo 1 \u003e /tmp/cg1/A/B/D/cpuset.cpus.exclusive\n  echo root \u003e /tmp/cg1/A/B/D/cpuset.cpus.partition\n\nwhich triggers:\n\n  WARNING: kernel/cgroup/cpuset.c:1594 at remote_partition_enable+0x1c1/0x300\n\nand leaves both /tmp/cg1/A and /tmp/cg1/A/B/D as active root partitions\nclaiming exclusive CPU 1.\n\nFix this by returning PERR_NOCPUS when tmp-\u003enew_cpus intersects\nsubpartitions_cpus in remote_partition_enable(), matching the error code\nused by remote_cpus_update() for the same subpartitions_cpus conflict, and\nadd a regression test case to\ntools/testing/selftests/cgroup/test_cpuset_prs.sh.\n\nTested in QEMU on Linux 7.3.0-rc3 using the reproducer above and\ntools/testing/selftests/cgroup/test_cpuset_prs.sh.",
  "id": "CVE-2026-98542",
  "modified": "2026-10-20T02:30:14.261121985Z",
  "published": "2026-10-18T15:18:10.035Z",
  "references": [
    {
      "type": "PACKAGE",
      "url": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/0751ab665cb3dcdac224b002565f2e28461740d5"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/241e67b60308cdce25bba66616a109759edd1d40"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/31c88350b7dd1522792f726f79607f31bb55c50f"
    },
    {
      "type": "ADVISORY",
      "url": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/98xxx/CVE-2026-98542.json"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-98542"
    }
  ],
  "schema_version": "1.9.0",
  "summary": "cgroup/cpuset: Return PERR_NOCPUS in remote_partition_enable() on subpartitions_cpus conflict"
}