{"id":"CVE-2026-98536","revision":"5c26c7cbf1664693a551f30689d6875c","records":[{"revision":"5c26c7cbf1664693a551f30689d6875c","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-98536","aliases":[],"title":"writeback: report a Tasks-RCU quiescent state per cgwb drain pass","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nwriteback: report a Tasks-RCU quiescent state per cgwb drain pass\n\ncleanup_offline_cgwbs_workfn() drains a dying cgwb by calling\ncleanup_offline_cgwb() until it returns false, with a cond_resched()\nbetween passes.  On a CONFIG_PREEMPTION kernel that cond_resched() does\nnothing: _cond_resched() is a plain \"return 0\", and under PREEMPT_DYNAMIC\nthe full and lazy modes disable it.  Since commit 7dadeaa6e851 (\"sched:\nFurther restrict the preemption modes\") those are the only two models on\nthe architectures with PREEMPT_LAZY support, arm64 and x86 among them, so\nthe drain loop never reports a Tasks-RCU quiescent state.\n\nA worker draining a cgwb with millions of attached inodes runs for\nminutes.  On a 6.18 arm64 host in lazy mode the cgwb worker drained one\ndying cgroup's writeback domain for over 11 minutes.  A BPF program unlink\n(bpf_trampoline_unlink_prog -> bpf_trampoline_update ->\nunregister_ftrace_direct -> ftrace_shutdown -> synchronize_rcu_tasks())\nwaited on that grace period while holding the trampoline mutex, 42 tasks\nqueued behind it in D state, and the hung task detector fired at 614 s and\npanicked the host.  Any BPF or ftrace detach during a long drain inherits\nthe drain's length.\n\nFix this by calling cond_resched_tasks_rcu_qs() so we do not stall out\nanybody who calls sycnrhonize_rcu_tasks().  We put this in a do { } while\nloop because if we have many small cgroups cleanup_offline_cgwb() will\nreturn false and we will never call cond_resched_tasks_rcu_qs(), creating\nthe same problem.","state":0,"publishedAt":"2026-10-18T15:18:04.013+00:00","modifiedAt":"2026-10-19T09:21:19.73+00:00","affected":[{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"unaffected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"mm/backing-dev.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"c22d70a162d3cc177282c4487be4d54876ca55c8\",\n                            \"lessThan\": \"863049b4018237d1590cd13b16e9fe9c0faad2c6\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"c22d70a162d3cc177282c4487be4d54876ca55c8\",\n                            \"lessThan\": \"42462b5bb0dec57db7f85d0f77655c737d45754d\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"c22d70a162d3cc177282c4487be4d54876ca55c8\",\n                            \"lessThan\": \"ebf1555ad2821be06f87a88ffd9a2cab8d2200e1\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"c22d70a162d3cc177282c4487be4d54876ca55c8\",\n                            \"lessThan\": \"4eb889649eaf65f4a5727b04ba1c017b7d05bb16\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"c22d70a162d3cc177282c4487be4d54876ca55c8\",\n                            \"lessThan\": \"fd3bf32279df98751364b3609eb100a3e42f253b\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"c22d70a162d3cc177282c4487be4d54876ca55c8\",\n                            \"lessThan\": \"260f586a80e7f624dd7f069898a75a904f34d373\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"c22d70a162d3cc177282c4487be4d54876ca55c8\",\n                            \"lessThan\": \"407a5d205179a4ab186571b0e16ec42725dc77bc\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        }\n                    ]\n                }"},{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"affected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"mm/backing-dev.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"5.14\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"0\",\n                            \"lessThan\": \"5.14\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"5.15.222\",\n                            \"lessThanOrEqual\": \"5.15.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.1.189\",\n                            \"lessThanOrEqual\": \"6.1.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.6.158\",\n                            \"lessThanOrEqual\": \"6.6.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.12.112\",\n                            \"lessThanOrEqual\": \"6.12.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.18.55\",\n                            \"lessThanOrEqual\": \"6.18.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"7.2.9\",\n                            \"lessThanOrEqual\": \"7.2.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"7.3\",\n                            \"lessThanOrEqual\": \"*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"original_commit_for_fix\"\n                        }\n                    ]\n                }"}],"metrics":[],"references":["https://git.kernel.org/stable/c/863049b4018237d1590cd13b16e9fe9c0faad2c6","https://git.kernel.org/stable/c/42462b5bb0dec57db7f85d0f77655c737d45754d","https://git.kernel.org/stable/c/ebf1555ad2821be06f87a88ffd9a2cab8d2200e1","https://git.kernel.org/stable/c/4eb889649eaf65f4a5727b04ba1c017b7d05bb16","https://git.kernel.org/stable/c/fd3bf32279df98751364b3609eb100a3e42f253b","https://git.kernel.org/stable/c/260f586a80e7f624dd7f069898a75a904f34d373","https://git.kernel.org/stable/c/407a5d205179a4ab186571b0e16ec42725dc77bc"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-98536","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-98536","identifiers":["CVE-2026-98536"]},"retained":false,"historicalAffected":[]}],"coverage":[]}