CVE-2026-46223

Descripción

In the Linux kernel, the following vulnerability has been resolved: cgroup: Defer css percpu_ref kill on rmdir until cgroup is depopulated A chain of commits going back to v7.0 reworked rmdir to satisfy the controller invariant that a subsystem-s ->css_offline() must not run while tasks are still doing kernel-side work in the cgroup. [1] d245698d727a (-cgroup: Defer task cgroup unlink until after the task is done switching out-) [2] a72f73c4dd9b (-cgroup: Don-t expose dead tasks in cgroup-) [3] 1b164b876c36 (-cgroup: Wait for dying tasks to leave on rmdir-) [4] 4c56a8ac6869 (-cgroup: Fix cgroup_drain_dying() testing the wrong condition-) [5] 13e786b64bd3 (-cgroup: Increment nr_dying_subsys_* from rmdir context-) [1] moved task cset unlink from do_exit() to finish_task_switch() so a task-s cset link drops only after the task has fully stopped scheduling. That made tasks past exit_signals() linger on cset->tasks until their final context switch, which led to a series of problems as what ...