CVE-2026-98536

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

writeback: report a Tasks-RCU quiescent state per cgwb drain pass

cleanup_offline_cgwbs_workfn() drains a dying cgwb by calling

cleanup_offline_cgwb() until it returns false, with a cond_resched()

between passes. On a CONFIG_PREEMPTION kernel that cond_resched() does

nothing: _cond_resched() is a plain "return 0", and under PREEMPT_DYNAMIC

the full and lazy modes disable it. Since commit 7dadeaa6e851 ("sched:

Further restrict the preemption modes") those are the only two models on

the architectures with PREEMPT_LAZY support, arm64 and x86 among them, so

the drain loop never reports a Tasks-RCU quiescent state.

A worker draining a cgwb with millions of attached inodes runs for

minutes. On a 6.18 arm64 host in lazy mode the cgwb worker drained one

dying cgroup's writeback domain for over 11 minutes. A BPF program unlink

(bpf_trampoline_unlink_prog -> bpf_trampoline_update ->

unregister_ftrace_direct -> ftrace_shut

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References