writeback: report a Tasks-RCU quiescent state per cgwb drain pass

MITRE NVD CVE.ORG JSON API

Summary

CVECVE-2026-98536
StatePUBLISHED
AssignerLinux
Source PriorityCVE Program / NVD first with legacy fallback
Published2026-10-18 16:17:05 UTC
Updated2026-10-18 16:17:05 UTC
DescriptionIn the Linux kernel, the following vulnerability has been resolved: writeback: report a Tasks-RCU quiescent state per cgwb drain pass cleanup_offline_cgwbs_workfn() drains a dying cgwb by calling cleanup_offline_cgwb() until it returns false, with a cond_resched() between passes. On a CONFIG_PREEMPTION kernel that cond_resched() does nothing: _cond_resched() is a plain "return 0", and under PREEMPT_DYNAMIC the full and lazy modes disable it. Since commit 7dadeaa6e851 ("sched: Further restrict the preemption modes") those are the only two models on the architectures with PREEMPT_LAZY support, arm64 and x86 among them, so the drain loop never reports a Tasks-RCU quiescent state. A worker draining a cgwb with millions of attached inodes runs for minutes. On a 6.18 arm64 host in lazy mode the cgwb worker drained one dying cgroup's writeback domain for over 11 minutes. A BPF program unlink (bpf_trampoline_unlink_prog -> bpf_trampoline_update -> unregister_ftrace_direct -> ftrace_shutdown -> synchronize_rcu_tasks()) waited on that grace period while holding the trampoline mutex, 42 tasks queued behind it in D state, and the hung task detector fired at 614 s and panicked the host. Any BPF or ftrace detach during a long drain inherits the drain's length. Fix this by calling cond_resched_tasks_rcu_qs() so we do not stall out anybody who calls sycnrhonize_rcu_tasks(). We put this in a do { } while loop because if we have many small cgroups cleanup_offline_cgwb() will return false and we will never call cond_resched_tasks_rcu_qs(), creating the same problem.

Vendor Declared Affected Products

SourceVendorProductVersionPlatforms
CNA Linux Linux affected c22d70a162d3cc177282c4487be4d54876ca55c8 863049b4018237d1590cd13b16e9fe9c0faad2c6 git Not specified
CNA Linux Linux affected c22d70a162d3cc177282c4487be4d54876ca55c8 42462b5bb0dec57db7f85d0f77655c737d45754d git Not specified
CNA Linux Linux affected c22d70a162d3cc177282c4487be4d54876ca55c8 ebf1555ad2821be06f87a88ffd9a2cab8d2200e1 git Not specified
CNA Linux Linux affected c22d70a162d3cc177282c4487be4d54876ca55c8 4eb889649eaf65f4a5727b04ba1c017b7d05bb16 git Not specified
CNA Linux Linux affected c22d70a162d3cc177282c4487be4d54876ca55c8 fd3bf32279df98751364b3609eb100a3e42f253b git Not specified
CNA Linux Linux affected c22d70a162d3cc177282c4487be4d54876ca55c8 260f586a80e7f624dd7f069898a75a904f34d373 git Not specified
CNA Linux Linux affected c22d70a162d3cc177282c4487be4d54876ca55c8 407a5d205179a4ab186571b0e16ec42725dc77bc git Not specified
CNA Linux Linux affected 5.14 Not specified
CNA Linux Linux unaffected 5.14 semver Not specified
CNA Linux Linux unaffected 5.15.222 5.15.* semver Not specified
CNA Linux Linux unaffected 6.1.189 6.1.* semver Not specified
CNA Linux Linux unaffected 6.6.158 6.6.* semver Not specified
CNA Linux Linux unaffected 6.12.112 6.12.* semver Not specified
CNA Linux Linux unaffected 6.18.55 6.18.* semver Not specified
CNA Linux Linux unaffected 7.2.9 7.2.* semver Not specified
CNA Linux Linux unaffected 7.3 * original_commit_for_fix Not specified

References

ReferenceSourceLinkTags
git.kernel.org/stable/c/4eb889649eaf65f4a5727b04ba1c017b7d05bb16 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/fd3bf32279df98751364b3609eb100a3e42f253b 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/42462b5bb0dec57db7f85d0f77655c737d45754d 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/407a5d205179a4ab186571b0e16ec42725dc77bc 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/260f586a80e7f624dd7f069898a75a904f34d373 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/ebf1555ad2821be06f87a88ffd9a2cab8d2200e1 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/863049b4018237d1590cd13b16e9fe9c0faad2c6 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
CVE Program record CVE.ORG www.cve.org canonical
NVD vulnerability detail NVD nvd.nist.gov canonical, analysis

© CVE.report 2026

Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.

CVE, CWE, and OVAL are registred trademarks of The MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. This site includes MITRE data granted under the following license.

Free CVE JSON API cve.report/api

CVE.report and Source URL Uptime Status status.cve.report