Look up another CVE · open CVE-2026-74594 in the interactive tracker
CVE-2026-74594
sched/psi: Shut down rtpoll_timer in psi_cgroup_free()
Published 2026-08-22 (2 months ago) by the Linux kernel CNA. Subsystem kernel/sched. Debian urgency: not yet assigned.
What to do, per Debian release
Debian's own status for CVE-2026-74594 in every release this site tracks, and what each one means in practice. Every status below is the one the Debian Security Team publishes for this CVE. source
| Release | Status | Version | What this means |
|---|---|---|---|
| Debian 12bookworm | fixedDLA-4777-1 · 2026-09-08 · text | 6.1.187-1 | Update the kernel and reboot. DLA-4777-1 shipped the fix on 2026-09-08, in 6.1.187-1. A running kernel keeps the old code until the machine restarts. |
| Debian 13trixie | fixedDSA-6466-1 · 2026-08-25 · text | 6.12.105-1 | Update the kernel and reboot. DSA-6466-1 shipped the fix on 2026-08-25, in 6.12.105-1. A running kernel keeps the old code until the machine restarts. |
| Debian 14forky | fixed | 7.1.9-1 | Update the kernel and reboot. Fixed in 7.1.9-1. A running kernel keeps the old code until the machine restarts. |
| Debian unstablesid | fixed | 7.1.9-1 | Update the kernel and reboot. Fixed in 7.1.9-1. A running kernel keeps the old code until the machine restarts. |
| Debian 12bookworm · linux-6.12 | fixedDLA-4788-1 · 2026-09-19 · text | 6.12.107-1~deb12u1 | Update the kernel and reboot. DLA-4788-1 shipped the fix on 2026-09-19, in 6.12.107-1~deb12u1. A running kernel keeps the old code until the machine restarts. |
The vulnerability
What the bug is
psi_schedule_rtpoll_work() is called locklessly from the scheduler hotpath and can race psi_trigger_destroy() taking down the last rtpoll trigger under rtpoll_trigger_lock: psi_schedule_rtpoll_work() psi_trigger_destroy() rcu_read_lock(); task = rcu_dereference(rtpoll_task); rcu_assign_pointer(rtpoll_task, NULL); timer_delete(&rtpoll_timer); mod_timer(&rtpoll_timer, ...); rcu_read_unlock(); synchronize_rcu(); kthread_stop(task_to_destroy); The group can then be freed with the re-armed timer still pending, and poll_timer_fn() runs on freed memory. 461daba06bdc ("psi: eliminate kthread_worker from psi trigger scheduling mechanism") deleted the timer synchronously after the synchronize_rcu(), which prevented this but raced trigger creation instead: the deletion could cancel the timer that a new trigger set armed during the grace period and, as creation also reinitialized the timer at the time, corrupt it. 8f91efd870ea ("psi: Fix race between psi_trigger_create/destroy") moved the initialization into group_init() and the deletion into the locked section, trading the creation races for the window above. Neither placement in the destruction path works. A pending timer firing while the group is alive is harmless though. poll_timer_fn() just wakes the rtpoll waitqueue and doesn't re-arm itself. Bind the timer to the group's lifetime instead and shut it down in psi_cgroup_free(). Nothing can arm it by then. timer_shutdown_sync() because the timer is never armed again.
Where it lives
The fix touches these files. If the subsystem is one you do not use, the practical exposure is lower, though the package is still the vulnerable one.
kernel/sched/psi.c
- What this is
- PRESSURE STALL INFORMATION (PSI)MAINTAINERS section matched on kernel/sched/psi.c · Maintained
Show whether Debian builds this, per release
Not established. This site could not find the build rule for the affected file in the kernel trees Debian ships, so it has no answer about whether Debian compiles this code. Read that as unknown, never as absent.
- bookworm, trixie, forky, sid, bookworm · linux-6.12?
- ?
- not established - no Makefile entry for the affected file
Where a release above reads "not established", no build rule for the affected file was found in that release's kernel tree. That is a gap in this lookup, not a finding that the code is absent.
From the configuration Debian publishes for every kernel flavour it builds. It covers only the architectures Debian ships a linux-config package for, and nothing about a kernel you built yourself. Debian's own status above stays authoritative about the source package.MAINTAINERS
Signals
- Published
- 2026-08-22 (2 months ago)source
- CVSS
- 7.8 high
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:Hsource recompute it - Attack vector
- local (AV:L)source
- EPSS
- 0.13%, higher than 2.3% of all CVEssource
- CISA KEV
- not listedthe KEV catalogue
- Debian urgency
- not yet assignedsource
- Subsystem
- kernel/sched
Upstream fixes
The versions the CNA records as introducing and fixing this, and the commit for each. source
| Introduced | Fixed in | Commit |
|---|---|---|
| 5.10.50 | 5.10.266 | 4addb102154b |
| 5.14 | 5.15.217 | 894a9300d7fb |
| 5.14 | 6.1.183 | 1e5ca82eee59 |
| 5.14 | 6.6.152 | 310b5a537a78 |
| 5.14 | 6.12.104 | 806fcff98c1d |
| 5.14 | 6.18.45 | 8037c5b2b2a4 |
| 5.14 | 7.1.9 | 611e7821c4f8 |
| 5.14 | 7.2 | 5457025fa8ca |
| 5.12.17 | 0 | 0 |
| 5.13.2 | 0 | 0 |
Debian advisories
| Advisory | Date | Shipped to | Debian |
|---|---|---|---|
| DLA-4788-1 | 2026-09-19 | bookworm 6.12.107-1~deb12u1 | tracker |
| DLA-4777-1 | 2026-09-08 | bookworm 6.1.187-1 | tracker |
| DSA-6466-1 | 2026-08-25 | trixie 6.12.105-1 | tracker |
Why the CNA scored it this way
Quoted from the kernel CNA's own scoring file, word for word. A highlighted metric carries the most severe value CVSS v3.1 defines for it, which is what pushes the score up. source
- AV:LAttack vector, local
- Reachable only via local kernel interfaces: writing cgroup *.pressure or /proc/pressure/*, closing the trigger fd, and removing the cgroup; the race involves scheduler hotpath callbacks, not any network protocol.
- AC:LAttack complexity, low
- The attacker controls both race participants—closing/destroying the last privileged PSI trigger while concurrently driving psi_schedule_rtpoll_work() via cgroup task scheduling or the psimon worker—so the mod_timer-after-timer_delete window is reliably winnable.
- PR:LPrivileges required, low
- The vulnerable rtpoll path requires CAP_SYS_RESOURCE (non-2s PSI windows); that capability is available to an unprivileged user who creates a user namespace, and cgroup pressure files are writable under delegated cgroup v2 hierarchies in that namespace.
- UI:NUser interaction, none
- Exploitation is fully self-driven: the attacker creates the trigger, races its teardown against scheduler activity, and deletes the cgroup; no separate victim action such as mounting a filesystem or opening a file is required.
- S:UScope, unchanged
- Impact is confined to kernel memory corruption and potential local privilege escalation within the same kernel security authority; it does not cross a VM, container runtime, or IOMMU trust boundary.
- C:HConfidentiality impact, high
- After psi_cgroup_free() the pending rtpoll_timer fires poll_timer_fn() on a freed psi_group, a classic use-after-free that can expose or corrupt adjacent slab contents and be developed into arbitrary kernel memory read primitives.
- I:HIntegrity impact, high
- poll_timer_fn() performs atomic_set() on group->rtpoll_wakeup and wake_up_interruptible() on group->rtpoll_wait after the psi_group is freed, giving attacker-influenced writes into a recycled kmem object suitable for control-flow hijacking.
- A:HAvailability impact, high
- Timer execution on freed psi_group memory can cause immediate kernel oops/panic from invalid pointer dereferences or list corruption, and the race can be retriggered for sustained denial of service on shared cloud/container hosts.