CVE-2026-98542

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-98542", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-09-25T10:25:14.356Z", "datePublished": "2026-10-18T15:18:10.035Z", "dateUpdated": "2026-10-19T09:21:25.599Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-10-19T09:21:25.599Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ncgroup/cpuset: Return PERR_NOCPUS in remote_partition_enable() on subpartitions_cpus conflict\n\nWhen a remote partition is created underneath an existing local partition\nvia a non-partition (PRS_MEMBER) intermediate cgroup, update_prstate() sees\nparent->partition_root_state == PRS_MEMBER and calls\nremote_partition_enable().\n\nCommit 86888c7bd117 (\"cgroup/cpuset: Add warnings to catch inconsistency\nin exclusive CPUs\") replaced the cpumask_intersects(tmp->new_cpus,\nsubpartitions_cpus) error check in remote_partition_enable() with\nWARN_ON_ONCE(). As a result, remote_partition_enable() emits a warning\nand proceeds to enable the remote partition on CPUs that are already\nowned by the ancestor local partition in subpartitions_cpus.\n\nThis can be reproduced on Linux 7.3.0-rc3 with:\n\n mkdir -p /tmp/cg1\n mount -t cgroup2 none /tmp/cg1\n echo \"+cpuset\" > /tmp/cg1/cgroup.subtree_control\n\n mkdir /tmp/cg1/A\n echo 1 > /tmp/cg1/A/cpuset.cpus\n echo 1 > /tmp/cg1/A/cpuset.cpus.exclusive\n echo root > /tmp/cg1/A/cpuset.cpus.partition\n echo \"+cpuset\" > /tmp/cg1/A/cgroup.subtree_control\n\n mkdir /tmp/cg1/A/B\n echo 1 > /tmp/cg1/A/B/cpuset.cpus\n echo 1 > /tmp/cg1/A/B/cpuset.cpus.exclusive\n echo \"+cpuset\" > /tmp/cg1/A/B/cgroup.subtree_control\n\n mkdir /tmp/cg1/A/B/D\n echo 1 > /tmp/cg1/A/B/D/cpuset.cpus\n echo 1 > /tmp/cg1/A/B/D/cpuset.cpus.exclusive\n echo root > /tmp/cg1/A/B/D/cpuset.cpus.partition\n\nwhich triggers:\n\n WARNING: kernel/cgroup/cpuset.c:1594 at remote_partition_enable+0x1c1/0x300\n\nand leaves both /tmp/cg1/A and /tmp/cg1/A/B/D as active root partitions\nclaiming exclusive CPU 1.\n\nFix this by returning PERR_NOCPUS when tmp->new_cpus intersects\nsubpartitions_cpus in remote_partition_enable(), matching the error code\nused by remote_cpus_update() for the same subpartitions_cpus conflict, and\nadd a regression test case to\ntools/testing/selftests/cgroup/test_cpuset_prs.sh.\n\nTested in QEMU on Linux 7.3.0-rc3 using the reproducer above and\ntools/testing/selftests/cgroup/test_cpuset_prs.sh."}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["kernel/cgroup/cpuset.c", "tools/testing/selftests/cgroup/test_cpuset_prs.sh"], "versions": [{"version": "86888c7bd117c29eab169c37e5f6bbbf583da983", "lessThan": "241e67b60308cdce25bba66616a109759edd1d40", "status": "affected", "versionType": "git"}, {"version": "86888c7bd117c29eab169c37e5f6bbbf583da983", "lessThan": "0751ab665cb3dcdac224b002565f2e28461740d5", "status": "affected", "versionType": "git"}, {"version": "86888c7bd117c29eab169c37e5f6bbbf583da983", "lessThan": "31c88350b7dd1522792f726f79607f31bb55c50f", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["kernel/cgroup/cpuset.c", "tools/testing/selftests/cgroup/test_cpuset_prs.sh"], "versions": [{"version": "6.16", "status": "affected"}, {"version": "0", "lessThan": "6.16", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.55", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2.9", "lessThanOrEqual": "7.2.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.3", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.16", "versionEndExcluding": "6.18.55"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.16", "versionEndExcluding": "7.2.9"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.16", "versionEndExcluding": "7.3"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/241e67b60308cdce25bba66616a109759edd1d40"}, {"url": "https://git.kernel.org/stable/c/0751ab665cb3dcdac224b002565f2e28461740d5"}, {"url": "https://git.kernel.org/stable/c/31c88350b7dd1522792f726f79607f31bb55c50f"}], "title": "cgroup/cpuset: Return PERR_NOCPUS in remote_partition_enable() on subpartitions_cpus conflict", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["kernel/cgroup/cpuset.c", "tools/testing/selftests/cgroup/test_cpuset_prs.sh"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "241e67b60308cdce25bba66616a109759edd1d40", "status": "affected", "version": "86888c7bd117c29eab169c37e5f6bbbf583da983", "versionType": "git"}, {"lessThan": "0751ab665cb3dcdac224b002565f2e28461740d5", "status": "affected", "version": "86888c7bd117c29eab169c37e5f6bbbf583da983", "versionType": "git"}, {"lessThan": "31c88350b7dd1522792f726f79607f31bb55c50f", "status": "affected", "version": "86888c7bd117c29eab169c37e5f6bbbf583da983", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["kernel/cgroup/cpuset.c", "tools/testing/selftests/cgroup/test_cpuset_prs.sh"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "6.16"}, {"lessThan": "6.16", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.55", "versionType": "semver"}, {"lessThanOrEqual": "7.2.*", "status": "unaffected", "version": "7.2.9", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.3", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ncgroup/cpuset: Return PERR_NOCPUS in remote_partition_enable() on subpartitions_cpus conflict\n\nWhen a remote partition is created underneath an existing local partition\nvia a non-partition (PRS_MEMBER) intermediate cgroup, update_prstate() sees\nparent->partition_root_state == PRS_MEMBER and calls\nremote_partition_enable().\n\nCommit 86888c7bd117 (\"cgroup/cpuset: Add warnings to catch inconsistency\nin exclusive CPUs\") replaced the cpumask_intersects(tmp->new_cpus,\nsubpartitions_cpus) error check in remote_partition_enable() with\nWARN_ON_ONCE(). As a result, remote_partition_enable() emits a warning\nand proceeds to enable the remote partition on CPUs that are already\nowned by the ancestor local partition in subpartitions_cpus.\n\nThis can be reproduced on Linux 7.3.0-rc3 with:\n\n mkdir -p /tmp/cg1\n mount -t cgroup2 none /tmp/cg1\n echo \"+cpuset\" > /tmp/cg1/cgroup.subtree_control\n\n mkdir /tmp/cg1/A\n echo 1 > /tmp/cg1/A/cpuset.cpus\n echo 1 > /tmp/cg1/A/cpuset.cpus.exclusive\n echo root > /tmp/cg1/A/cpuset.cpus.partition\n echo \"+cpuset\" > /tmp/cg1/A/cgroup.subtree_control\n\n mkdir /tmp/cg1/A/B\n echo 1 > /tmp/cg1/A/B/cpuset.cpus\n echo 1 > /tmp/cg1/A/B/cpuset.cpus.exclusive\n echo \"+cpuset\" > /tmp/cg1/A/B/cgroup.subtree_control\n\n mkdir /tmp/cg1/A/B/D\n echo 1 > /tmp/cg1/A/B/D/cpuset.cpus\n echo 1 > /tmp/cg1/A/B/D/cpuset.cpus.exclusive\n echo root > /tmp/cg1/A/B/D/cpuset.cpus.partition\n\nwhich triggers:\n\n WARNING: kernel/cgroup/cpuset.c:1594 at remote_partition_enable+0x1c1/0x300\n\nand leaves both /tmp/cg1/A and /tmp/cg1/A/B/D as active root partitions\nclaiming exclusive CPU 1.\n\nFix this by returning PERR_NOCPUS when tmp->new_cpus intersects\nsubpartitions_cpus in remote_partition_enable(), matching the error code\nused by remote_cpus_update() for the same subpartitions_cpus conflict, and\nadd a regression test case to\ntools/testing/selftests/cgroup/test_cpuset_prs.sh.\n\nTested in QEMU on Linux 7.3.0-rc3 using the reproducer above and\ntools/testing/selftests/cgroup/test_cpuset_prs.sh."}], "id": "CVE-2026-98542", "lastModified": "2026-10-19T10:19:10.107", "metrics": {}, "published": "2026-10-18T16:17:06.090", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/0751ab665cb3dcdac224b002565f2e28461740d5"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/241e67b60308cdce25bba66616a109759edd1d40"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/31c88350b7dd1522792f726f79607f31bb55c50f"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{"bugzilla": {"description": "kernel: cgroup/cpuset: Return PERR_NOCPUS in remote_partition_enable() on subpartitions_cpus conflict", "id": "2554922", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2554922"}, "csaw": false, "cvss3": {"cvss3_base_score": "2.3", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:L", "status": "draft"}, "cwe": "CWE-390", "details": ["In the Linux kernel, the following vulnerability has been resolved:\ncgroup/cpuset: Return PERR_NOCPUS in remote_partition_enable() on subpartitions_cpus conflict\nWhen a remote partition is created underneath an existing local partition\nvia a non-partition (PRS_MEMBER) intermediate cgroup, update_prstate() sees\nparent->partition_root_state == PRS_MEMBER and calls\nremote_partition_enable().\nCommit 86888c7bd117 (\"cgroup/cpuset: Add warnings to catch inconsistency\nin exclusive CPUs\") replaced the cpumask_intersects(tmp->new_cpus,\nsubpartitions_cpus) error check in remote_partition_enable() with\nWARN_ON_ONCE(). As a result, remote_partition_enable() emits a warning\nand proceeds to enable the remote partition on CPUs that are already\nowned by the ancestor local partition in subpartitions_cpus.\nThis can be reproduced on Linux 7.3.0-rc3 with:\nmkdir -p /tmp/cg1\nmount -t cgroup2 none /tmp/cg1\necho \"+cpuset\" > /tmp/cg1/cgroup.subtree_control\nmkdir /tmp/cg1/A\necho 1 > /tmp/cg1/A/cpuset.cpus\necho 1 > /tmp/cg1/A/cpuset.cpus.exclusive\necho root > /tmp/cg1/A/cpuset.cpus.partition\necho \"+cpuset\" > /tmp/cg1/A/cgroup.subtree_control\nmkdir /tmp/cg1/A/B\necho 1 > /tmp/cg1/A/B/cpuset.cpus\necho 1 > /tmp/cg1/A/B/cpuset.cpus.exclusive\necho \"+cpuset\" > /tmp/cg1/A/B/cgroup.subtree_control\nmkdir /tmp/cg1/A/B/D\necho 1 > /tmp/cg1/A/B/D/cpuset.cpus\necho 1 > /tmp/cg1/A/B/D/cpuset.cpus.exclusive\necho root > /tmp/cg1/A/B/D/cpuset.cpus.partition\nwhich triggers:\nWARNING: kernel/cgroup/cpuset.c:1594 at remote_partition_enable+0x1c1/0x300\nand leaves both /tmp/cg1/A and /tmp/cg1/A/B/D as active root partitions\nclaiming exclusive CPU 1.\nFix this by returning PERR_NOCPUS when tmp->new_cpus intersects\nsubpartitions_cpus in remote_partition_enable(), matching the error code\nused by remote_cpus_update() for the same subpartitions_cpus conflict, and\nadd a regression test case to\ntools/testing/selftests/cgroup/test_cpuset_prs.sh.\nTested in QEMU on Linux 7.3.0-rc3 using the reproducer above and\ntools/testing/selftests/cgroup/test_cpuset_prs.sh.", "A flaw was found in the Linux kernel's cpuset subsystem, which can lead to a denial of service (DoS) or compromised resource isolation. A local user with permissions to configure control groups (cgroups) can trigger this flaw by creating a remote partition that requests processor cores already allocated to an ancestor partition. Because the kernel fails to reject the conflicting request, multiple partitions can improperly claim exclusive access to the same central processing unit (CPU) cores, generating kernel warnings and causing inconsistent resource management."], "name": "CVE-2026-98542", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Not affected", "package_name": "openshift/ose-rhel-coreos-8", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Fix deferred", "package_name": "openshift/ose-rhel-coreos-9", "product_name": "Red Hat OpenShift Container Platform 4"}], "public_date": "2026-10-18T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-98542\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-98542\nhttps://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-98542.mbox"], "threat_severity": "Low"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[86888c7bd117c29eab169c37e5f6bbbf583da983,241e67b60308cdce25bba66616a109759edd1d40)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[86888c7bd117c29eab169c37e5f6bbbf583da983,0751ab665cb3dcdac224b002565f2e28461740d5)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[86888c7bd117c29eab169c37e5f6bbbf583da983,31c88350b7dd1522792f726f79607f31bb55c50f)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "6.16"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[0,6.16)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[6.18.55,6.19.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.2.9,7.3.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.3-rc5,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-10-18T23:30:14.147212+00:00", "updated": "2026-10-22T22:30:13.441560+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}