CVE-2026-98536

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-98536", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-09-25T10:25:14.355Z", "datePublished": "2026-10-18T15:18:04.013Z", "dateUpdated": "2026-10-19T09:21:19.730Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-10-19T09:21:19.730Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwriteback: report a Tasks-RCU quiescent state per cgwb drain pass\n\ncleanup_offline_cgwbs_workfn() drains a dying cgwb by calling\ncleanup_offline_cgwb() until it returns false, with a cond_resched()\nbetween passes. On a CONFIG_PREEMPTION kernel that cond_resched() does\nnothing: _cond_resched() is a plain \"return 0\", and under PREEMPT_DYNAMIC\nthe full and lazy modes disable it. Since commit 7dadeaa6e851 (\"sched:\nFurther restrict the preemption modes\") those are the only two models on\nthe architectures with PREEMPT_LAZY support, arm64 and x86 among them, so\nthe drain loop never reports a Tasks-RCU quiescent state.\n\nA worker draining a cgwb with millions of attached inodes runs for\nminutes. On a 6.18 arm64 host in lazy mode the cgwb worker drained one\ndying cgroup's writeback domain for over 11 minutes. A BPF program unlink\n(bpf_trampoline_unlink_prog -> bpf_trampoline_update ->\nunregister_ftrace_direct -> ftrace_shutdown -> synchronize_rcu_tasks())\nwaited on that grace period while holding the trampoline mutex, 42 tasks\nqueued behind it in D state, and the hung task detector fired at 614 s and\npanicked the host. Any BPF or ftrace detach during a long drain inherits\nthe drain's length.\n\nFix this by calling cond_resched_tasks_rcu_qs() so we do not stall out\nanybody who calls sycnrhonize_rcu_tasks(). We put this in a do { } while\nloop because if we have many small cgroups cleanup_offline_cgwb() will\nreturn false and we will never call cond_resched_tasks_rcu_qs(), creating\nthe same problem."}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["mm/backing-dev.c"], "versions": [{"version": "c22d70a162d3cc177282c4487be4d54876ca55c8", "lessThan": "863049b4018237d1590cd13b16e9fe9c0faad2c6", "status": "affected", "versionType": "git"}, {"version": "c22d70a162d3cc177282c4487be4d54876ca55c8", "lessThan": "42462b5bb0dec57db7f85d0f77655c737d45754d", "status": "affected", "versionType": "git"}, {"version": "c22d70a162d3cc177282c4487be4d54876ca55c8", "lessThan": "ebf1555ad2821be06f87a88ffd9a2cab8d2200e1", "status": "affected", "versionType": "git"}, {"version": "c22d70a162d3cc177282c4487be4d54876ca55c8", "lessThan": "4eb889649eaf65f4a5727b04ba1c017b7d05bb16", "status": "affected", "versionType": "git"}, {"version": "c22d70a162d3cc177282c4487be4d54876ca55c8", "lessThan": "fd3bf32279df98751364b3609eb100a3e42f253b", "status": "affected", "versionType": "git"}, {"version": "c22d70a162d3cc177282c4487be4d54876ca55c8", "lessThan": "260f586a80e7f624dd7f069898a75a904f34d373", "status": "affected", "versionType": "git"}, {"version": "c22d70a162d3cc177282c4487be4d54876ca55c8", "lessThan": "407a5d205179a4ab186571b0e16ec42725dc77bc", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["mm/backing-dev.c"], "versions": [{"version": "5.14", "status": "affected"}, {"version": "0", "lessThan": "5.14", "status": "unaffected", "versionType": "semver"}, {"version": "5.15.222", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.189", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.158", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.112", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.55", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2.9", "lessThanOrEqual": "7.2.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.3", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.14", "versionEndExcluding": "5.15.222"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.14", "versionEndExcluding": "6.1.189"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.14", "versionEndExcluding": "6.6.158"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.14", "versionEndExcluding": "6.12.112"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.14", "versionEndExcluding": "6.18.55"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.14", "versionEndExcluding": "7.2.9"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.14", "versionEndExcluding": "7.3"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/863049b4018237d1590cd13b16e9fe9c0faad2c6"}, {"url": "https://git.kernel.org/stable/c/42462b5bb0dec57db7f85d0f77655c737d45754d"}, {"url": "https://git.kernel.org/stable/c/ebf1555ad2821be06f87a88ffd9a2cab8d2200e1"}, {"url": "https://git.kernel.org/stable/c/4eb889649eaf65f4a5727b04ba1c017b7d05bb16"}, {"url": "https://git.kernel.org/stable/c/fd3bf32279df98751364b3609eb100a3e42f253b"}, {"url": "https://git.kernel.org/stable/c/260f586a80e7f624dd7f069898a75a904f34d373"}, {"url": "https://git.kernel.org/stable/c/407a5d205179a4ab186571b0e16ec42725dc77bc"}], "title": "writeback: report a Tasks-RCU quiescent state per cgwb drain pass", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["mm/backing-dev.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "863049b4018237d1590cd13b16e9fe9c0faad2c6", "status": "affected", "version": "c22d70a162d3cc177282c4487be4d54876ca55c8", "versionType": "git"}, {"lessThan": "42462b5bb0dec57db7f85d0f77655c737d45754d", "status": "affected", "version": "c22d70a162d3cc177282c4487be4d54876ca55c8", "versionType": "git"}, {"lessThan": "ebf1555ad2821be06f87a88ffd9a2cab8d2200e1", "status": "affected", "version": "c22d70a162d3cc177282c4487be4d54876ca55c8", "versionType": "git"}, {"lessThan": "4eb889649eaf65f4a5727b04ba1c017b7d05bb16", "status": "affected", "version": "c22d70a162d3cc177282c4487be4d54876ca55c8", "versionType": "git"}, {"lessThan": "fd3bf32279df98751364b3609eb100a3e42f253b", "status": "affected", "version": "c22d70a162d3cc177282c4487be4d54876ca55c8", "versionType": "git"}, {"lessThan": "260f586a80e7f624dd7f069898a75a904f34d373", "status": "affected", "version": "c22d70a162d3cc177282c4487be4d54876ca55c8", "versionType": "git"}, {"lessThan": "407a5d205179a4ab186571b0e16ec42725dc77bc", "status": "affected", "version": "c22d70a162d3cc177282c4487be4d54876ca55c8", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["mm/backing-dev.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "5.14"}, {"lessThan": "5.14", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "5.15.*", "status": "unaffected", "version": "5.15.222", "versionType": "semver"}, {"lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.189", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.158", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.112", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.55", "versionType": "semver"}, {"lessThanOrEqual": "7.2.*", "status": "unaffected", "version": "7.2.9", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.3", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwriteback: report a Tasks-RCU quiescent state per cgwb drain pass\n\ncleanup_offline_cgwbs_workfn() drains a dying cgwb by calling\ncleanup_offline_cgwb() until it returns false, with a cond_resched()\nbetween passes. On a CONFIG_PREEMPTION kernel that cond_resched() does\nnothing: _cond_resched() is a plain \"return 0\", and under PREEMPT_DYNAMIC\nthe full and lazy modes disable it. Since commit 7dadeaa6e851 (\"sched:\nFurther restrict the preemption modes\") those are the only two models on\nthe architectures with PREEMPT_LAZY support, arm64 and x86 among them, so\nthe drain loop never reports a Tasks-RCU quiescent state.\n\nA worker draining a cgwb with millions of attached inodes runs for\nminutes. On a 6.18 arm64 host in lazy mode the cgwb worker drained one\ndying cgroup's writeback domain for over 11 minutes. A BPF program unlink\n(bpf_trampoline_unlink_prog -> bpf_trampoline_update ->\nunregister_ftrace_direct -> ftrace_shutdown -> synchronize_rcu_tasks())\nwaited on that grace period while holding the trampoline mutex, 42 tasks\nqueued behind it in D state, and the hung task detector fired at 614 s and\npanicked the host. Any BPF or ftrace detach during a long drain inherits\nthe drain's length.\n\nFix this by calling cond_resched_tasks_rcu_qs() so we do not stall out\nanybody who calls sycnrhonize_rcu_tasks(). We put this in a do { } while\nloop because if we have many small cgroups cleanup_offline_cgwb() will\nreturn false and we will never call cond_resched_tasks_rcu_qs(), creating\nthe same problem."}], "id": "CVE-2026-98536", "lastModified": "2026-10-19T10:19:09.220", "metrics": {}, "published": "2026-10-18T16:17:05.357", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/260f586a80e7f624dd7f069898a75a904f34d373"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/407a5d205179a4ab186571b0e16ec42725dc77bc"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/42462b5bb0dec57db7f85d0f77655c737d45754d"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/4eb889649eaf65f4a5727b04ba1c017b7d05bb16"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/863049b4018237d1590cd13b16e9fe9c0faad2c6"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/ebf1555ad2821be06f87a88ffd9a2cab8d2200e1"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/fd3bf32279df98751364b3609eb100a3e42f253b"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{"bugzilla": {"description": "kernel: writeback: report a Tasks-RCU quiescent state per cgwb drain pass", "id": "2554933", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2554933"}, "csaw": false, "cvss3": {"cvss3_base_score": "4.7", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-821", "details": ["In the Linux kernel, the following vulnerability has been resolved:\nwriteback: report a Tasks-RCU quiescent state per cgwb drain pass\ncleanup_offline_cgwbs_workfn() drains a dying cgwb by calling\ncleanup_offline_cgwb() until it returns false, with a cond_resched()\nbetween passes. On a CONFIG_PREEMPTION kernel that cond_resched() does\nnothing: _cond_resched() is a plain \"return 0\", and under PREEMPT_DYNAMIC\nthe full and lazy modes disable it. Since commit 7dadeaa6e851 (\"sched:\nFurther restrict the preemption modes\") those are the only two models on\nthe architectures with PREEMPT_LAZY support, arm64 and x86 among them, so\nthe drain loop never reports a Tasks-RCU quiescent state.\nA worker draining a cgwb with millions of attached inodes runs for\nminutes. On a 6.18 arm64 host in lazy mode the cgwb worker drained one\ndying cgroup's writeback domain for over 11 minutes. A BPF program unlink\n(bpf_trampoline_unlink_prog -> bpf_trampoline_update ->\nunregister_ftrace_direct -> ftrace_shutdown -> synchronize_rcu_tasks())\nwaited on that grace period while holding the trampoline mutex, 42 tasks\nqueued behind it in D state, and the hung task detector fired at 614 s and\npanicked the host. Any BPF or ftrace detach during a long drain inherits\nthe drain's length.\nFix this by calling cond_resched_tasks_rcu_qs() so we do not stall out\nanybody who calls sycnrhonize_rcu_tasks(). We put this in a do { } while\nloop because if we have many small cgroups cleanup_offline_cgwb() will\nreturn false and we will never call cond_resched_tasks_rcu_qs(), creating\nthe same problem.", "A flaw was found in the Linux kernel's writeback subsystem. This vulnerability can lead to a Denial of Service (DoS) when the routine responsible for cleaning up offline control group writeback structures fails to report a quiescent state during extended cleanup passes under certain preemption configurations. A local user can trigger conditions that cause this prolonged draining to stall internal Read-Copy Update (RCU) synchronization mechanisms and block dependent system processes. This prolonged blockage can cause affected tasks to hang indefinitely, ultimately triggering the kernel hung task detector and crashing the system."], "name": "CVE-2026-98536", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Out of support scope", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Fix deferred", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Not affected", "package_name": "openshift/ose-rhel-coreos-8", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Fix deferred", "package_name": "openshift/ose-rhel-coreos-9", "product_name": "Red Hat OpenShift Container Platform 4"}], "public_date": "2026-10-18T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-98536\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-98536\nhttps://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-98536.mbox"], "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[c22d70a162d3cc177282c4487be4d54876ca55c8,863049b4018237d1590cd13b16e9fe9c0faad2c6)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[c22d70a162d3cc177282c4487be4d54876ca55c8,42462b5bb0dec57db7f85d0f77655c737d45754d)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[c22d70a162d3cc177282c4487be4d54876ca55c8,ebf1555ad2821be06f87a88ffd9a2cab8d2200e1)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[c22d70a162d3cc177282c4487be4d54876ca55c8,4eb889649eaf65f4a5727b04ba1c017b7d05bb16)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[c22d70a162d3cc177282c4487be4d54876ca55c8,fd3bf32279df98751364b3609eb100a3e42f253b)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[c22d70a162d3cc177282c4487be4d54876ca55c8,260f586a80e7f624dd7f069898a75a904f34d373)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[c22d70a162d3cc177282c4487be4d54876ca55c8,407a5d205179a4ab186571b0e16ec42725dc77bc)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "5.14"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[0,5.14)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[5.15.222,5.16.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.1.189,6.2.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.6.158,6.7.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.12.112,6.13.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.55,6.19.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.2.9,7.3.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.3-rc5,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-10-18T23:30:14.147352+00:00", "updated": "2026-10-20T16:30:06.794574+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}