CVE-2026-43439
- Source
- https://cve.org/CVERecord?id=CVE-2026-43439
- Import Source
- https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-43439.json
- JSON Data
- https://api.osv.dev/v1/vulns/CVE-2026-43439
- Downstream
- Published
- 2026-05-08T14:22:08.626Z
- Modified
- 2026-07-15T01:49:04.906851481Z
- Summary
- cgroup: fix race between task migration and iteration
- Details
-
In the Linux kernel, the following vulnerability has been resolved:
cgroup: fix race between task migration and iteration
When a task is migrated out of a cssset, cgroupmigrateaddtask() first moves it from cset->tasks to cset->mg_tasks via:
list_move_tail(&task->cg_list, &cset->mg_tasks);If a csstaskiter currently has it->taskpos pointing to this task, csssetmovetask() calls csstaskiterskip() to keep the iterator valid. However, since the task has already been moved to ->mgtasks, the iterator is advanced relative to the mgtasks list instead of the original tasks list. As a result, remaining tasks on cset->tasks, as well as tasks queued on cset->mgtasks, can be skipped by iteration.
Fix this by calling csssetskiptaskiters() before unlinking task->cg_list from cset->tasks. This advances all active iterators to the next task on cset->tasks, so iteration continues correctly even when a task is concurrently being migrated.
This race is hard to hit in practice without instrumentation, but it can be reproduced by artificially slowing down cgroupprocsshow(). For example, on an Android device a temporary /sys/kernel/cgroup/cgrouptest knob can be added to inject a delay into cgroupprocs_show(), and then:
1) Spawn three long-running tasks (PIDs 101, 102, 103). 2) Create a test cgroup and move the tasks into it. 3) Enable a large delay via /sys/kernel/cgroup/cgroup_test. 4) In one shell, read cgroup.procs from the test cgroup. 5) Within the delay window, in another shell migrate PID 102 by writing it to a different cgroup.procs file.
Under this setup, cgroup.procs can intermittently show only PID 101 while skipping PID 103. Once the migration completes, reading the file again shows all tasks as expected.
Note that this change does not allow removing the existing csssetskiptaskiters() call in csssetmovetask(). The new call in cgroupmigrateaddtask() only handles iterators that are racing with migration while the task is still on cset->tasks. Iterators may also start after the task has been moved to cset->mgtasks. If we dropped csssetskiptaskiters() from csssetmovetask(), such iterators could keep taskpos pointing to a migrating task, causing csstaskiteradvance() to malfunction on the destination css_set, up to and including crashes or infinite loops.
The race window between migration and iteration is very small, and csstaskiter is not on a hot path. In the worst case, when an iterator is positioned on the first thread of the migrating process, cgroupmigrateaddtask() may have to skip multiple tasks via csssetskiptask_iters(). However, this only happens when migration and iteration actually race, so the performance impact is negligible compared to the correctness fix provided here.
- Database specific
{ "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/43xxx/CVE-2026-43439.json", "cna_assigner": "Linux" }- References
-
- https://git.kernel.org/stable/c/3b95abab7369235a37b15eaec6e1a0b443bba7c7
- https://git.kernel.org/stable/c/3dfd1328c05234e8d8fa61948b2ba82680594988
- https://git.kernel.org/stable/c/4a9654a2b46cfdaae287fb8995f536245635e467
- https://git.kernel.org/stable/c/5ee01f1a7343d6a3547b6802ca2d4cdce0edacb1
- https://git.kernel.org/stable/c/7c85debc35e6d131bd29c64f2ae78c6ede0e55c4
- https://git.kernel.org/stable/c/86ceaccfdfa16dad05addb33dc206e03589bcfd1
- https://git.kernel.org/stable/c/9cca530c7cc1b3e02cb8fa7f80060dd4b38562ce
- https://git.kernel.org/stable/c/9dc76f6fc0d28d2382583715bc4ec22f28104845
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/43xxx/CVE-2026-43439.json
- https://nvd.nist.gov/vuln/detail/CVE-2026-43439
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Affected packages
Git / git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Affected ranges
- Type
- GIT
- Repo
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- Events
-
Introducedb636fd38dc40113f853337a7d2a6885ad23b8811Fixed7c85debc35e6d131bd29c64f2ae78c6ede0e55c4Fixed3b95abab7369235a37b15eaec6e1a0b443bba7c7Fixed4a9654a2b46cfdaae287fb8995f536245635e467Fixed3dfd1328c05234e8d8fa61948b2ba82680594988Fixed9cca530c7cc1b3e02cb8fa7f80060dd4b38562ceFixed86ceaccfdfa16dad05addb33dc206e03589bcfd1Fixed9dc76f6fc0d28d2382583715bc4ec22f28104845Fixed5ee01f1a7343d6a3547b6802ca2d4cdce0edacb1
- Type
- GIT
- Repo
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- Events
-
Introduced0 Unknown introduced commit / All previous commits are affectedLast affectedb0af004fd58ded5f898630db008c5b824c27d7dbLast affected370b9e6399da09fe10005fe455878b356de7b85f
- Type
- GIT
- Repo
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- Events
-
Introduced4.14.138Fixed4.15
- Type
- GIT
- Repo
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- Events
-
Introduced4.19.66Fixed4.20
Affected versions
v2.*
v3.*
v4.*
Linux / Kernel
Package
- Name
- Kernel
Affected ranges
- Type
- ECOSYSTEM
- Events
-
Introduced5.2.0Fixed5.10.253
- Type
- ECOSYSTEM
- Events
-
Introduced5.11.0Fixed5.15.203
- Type
- ECOSYSTEM
- Events
-
Introduced5.16.0Fixed6.1.167
- Type
- ECOSYSTEM
- Events
-
Introduced6.2.0Fixed6.6.130
- Type
- ECOSYSTEM
- Events
-
Introduced6.7.0Fixed6.12.78
- Type
- ECOSYSTEM
- Events
-
Introduced6.13.0Fixed6.18.19
- Type
- ECOSYSTEM
- Events
-
Introduced6.19.0Fixed6.19.9