{
  "affected": [
    {
      "ecosystem_specific": {
        "urgency": "not yet assigned"
      },
      "package": {
        "ecosystem": "Debian:12",
        "name": "linux"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "ecosystem_specific": {
        "urgency": "not yet assigned"
      },
      "package": {
        "ecosystem": "Debian:13",
        "name": "linux"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "ecosystem_specific": {
        "urgency": "not yet assigned"
      },
      "package": {
        "ecosystem": "Debian:14",
        "name": "linux"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "7.0.10-1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "details": "In the Linux kernel, the following vulnerability has been resolved:  sched/psi: fix race between file release and pressure write  A potential race condition exists between pressure write and cgroup file release regarding the priv member of struct kernfs_open_file, which triggers the uaf reported in [1].  Consider the following scenario involving execution on two separate CPUs:     CPU0\t\t\t\t\tCPU1    ====\t\t\t\t\t==== \t\t\t\t\tvfs_rmdir() \t\t\t\t\tkernfs_iop_rmdir() \t\t\t\t\tcgroup_rmdir() \t\t\t\t\tcgroup_kn_lock_live() \t\t\t\t\tcgroup_destroy_locked() \t\t\t\t\tcgroup_addrm_files() \t\t\t\t\tcgroup_rm_file() \t\t\t\t\tkernfs_remove_by_name() \t\t\t\t\tkernfs_remove_by_name_ns()  vfs_write()\t\t\t\t__kernfs_remove()  new_sync_write()\t\t\tkernfs_drain()  kernfs_fop_write_iter()\t\tkernfs_drain_open_files()  cgroup_file_write()\t\t\tkernfs_release_file()  pressure_write()\t\t\tcgroup_file_release()  ctx = of-\u003epriv; \t\t\t\t\tkfree(ctx);  \t\t\t\t\tof-\u003epriv = NULL; \t\t\t\t\tcgroup_kn_unlock()  cgroup_kn_lock_live()  cgroup_get(cgrp)  cgroup_kn_unlock()  if (ctx-\u003epsi.trigger)  // here, trigger uaf for ctx, that is of-\u003epriv  The cgroup_rmdir() is protected by the cgroup_mutex, it also safeguards the memory deallocation of of-\u003epriv performed within cgroup_file_release(). However, the operations involving of-\u003epriv executed within pressure_write() are not entirely covered by the protection of cgroup_mutex. Consequently, if the code in pressure_write(), specifically the section handling the ctx variable executes after cgroup_file_release() has completed, a uaf vulnerability involving of-\u003epriv is triggered.  Therefore, the issue can be resolved by extending the scope of the cgroup_mutex lock within pressure_write() to encompass all code paths involving of-\u003epriv, thereby properly synchronizing the race condition occurring between cgroup_file_release() and pressure_write().  And, if an live kn lock can be successfully acquired while executing the pressure write operation, it indicates that the cgroup deletion process has not yet reached its final stage; consequently, the priv pointer within open_file cannot be NULL. Therefore, the operation to retrieve the ctx value must be moved to a point *after* the live kn lock has been successfully acquired.  In another situation, specifically after entering cgroup_kn_lock_live() but before acquiring cgroup_mutex, there exists a different class of race condition:  CPU0: write memory.pressure               CPU1: write cgroup.pressure=0 ===========================\t\t  =============================  kernfs_fop_write_iter()  kernfs_get_active_of(of)  pressure_write()    cgroup_kn_lock_live(memory.pressure)      cgroup_tryget(cgrp)      kernfs_break_active_protection(kn)      ... blocks on cgroup_mutex                                       \t  cgroup_pressure_write()                                      \t  cgroup_kn_lock_live(cgroup.pressure)                                      \t  cgroup_file_show(memory.pressure, false)                                      \t    kernfs_show(false)                                      \t      kernfs_drain_open_files()                                      \t        cgroup_file_release(of)                                      \t          kfree(ctx)                                      \t            of-\u003epriv = NULL                                      \t  cgroup_kn_unlock()     ... acquires cgroup_mutex    ctx = of-\u003epriv;        // may now be NULL    if (ctx-\u003epsi.trigger)  // NULL dereference  Consequently, there is a possibility that of-\u003epriv is NULL, the pressure write needs to check for this.  Now that the scope of the cgroup_mutex has been expanded, the original explicit cgroup_get/put operations are no longer necessary, this is because acquiring/releasing the live kn lock inherently executes a cgroup get/put operation.  [1] BUG: KASAN: slab-use-after-free in pressure_write+0xa4/0x210 kernel/cgroup/cgroup.c:4011 Call Trace:  pressure_write+0xa4/0x210 kernel/cgroup/cgroup.c:4011  cgroup_file_write+0x36f/0x790 kernel/cgroup/cgroup.c:43 ---truncated---",
  "id": "DEBIAN-CVE-2026-52991",
  "modified": "2026-09-14T16:47:32.372382229Z",
  "published": "2026-06-24T17:17:09.953Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://security-tracker.debian.org/tracker/CVE-2026-52991"
    }
  ],
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "upstream": [
    "CVE-2026-52991"
  ]
}