CVE-2026-98163

Executive Summary

CVE-2026-98163 is a use-after-free vulnerability in the Linux kernel cgroup subsystem, introduced by commit 260fbcb92bbea which extended the lifetime of tasks on the dying_tasks list. When a task in the race window between cgroup_task_release() and cgroup_task_free() has its ->usage reference count drop to zero, css_task_iter_next() can return a task_struct that is already being freed by __put_task_struct_rcu_cb().

The vulnerability affects Linux kernel versions containing the introducing commit and not yet patched. Impact is local privilege escalation or denial of service due to use-after-free on a task_struct, though exploitation requires a race condition and local access.

Technical Analysis

The Linux cgroup subsystem maintains a dying_tasks list of tasks that are exiting but still referenced by iterators. Commit 260fbcb92bbea moved the dying_tasks cleanup from cgroup_task_release() to cgroup_task_free(), extending how long a task remains on the list after its reference count is released. The iterators (css_task_iter) have provisions to traverse dying_tasks for dying threadgroup leaders or when CSS_TASK_ITER_WITH_DEAD is specified, with the expectation that any task encountered can still obtain a new reference — which is only valid before cgroup_task_release()/put_task_struct_rcu_user().

The race window occurs between calls to css_task_iter_next(). Because css_set_lock is released between invocations, the iterator's internal ->task_pos may advance to a task whose ->usage count has already dropped to zero during that gap. Such a task is in an RCU remnant state: __put_task_struct_rcu_cb() is imminent, and returning that task_struct to the caller can result in use-after-free when the caller dereferences it.

A naive fix of checking signal->live is insufficient because it cannot distinguish a regular zombie awaiting reap from an RCU remnant task that is about to be freed. The correct fix — reflected in the upstream resolution — is to add an explicit ->usage==0 check so any iteration skips de-used tasks on the dying_list. The existing "repeat:" loop in css_task_iter_advance() does not consider ->usage, so a new loop was added in css_task_iter_next() to skip such tasks.

Attack surface: any local user able to trigger cgroup iteration concurrently with task exit — for example via /proc enumeration, cgroup filesystem reads, or kernel interfaces exercising css_task_iter — combined with rapid process creation/termination to widen the race.

Exploitation Scenarios

1. Reconnaissance: The attacker has local access to a system running a kernel in the affected version range. No network-facing reconnaissance is applicable; the vulnerable surface is the local kernel cgroup iteration code path.
2. Triggering the flaw: The attacker runs processes that repeatedly exit while simultaneously invoking interfaces that drive css_task_iter_next() (for example cgroupfs reads or process enumeration paths that iterate dying tasks). By racing the release of css_set_lock against task teardown, the iterator can be made to reach a ->task_pos whose task_struct has ->usage==0 but has not yet been freed by __put_task_struct_rcu_cb().
3. Execution/payload: The race is inherent to the vulnerability class — no specific PoC is publicly available. At the vulnerability-class level, the attacker wins a use-after-free race against RCU callback execution, causing css_task_iter_next() to return a task_struct already slated for reclamation.
4. Post-exploitation: Consequences of a use-after-free on task_struct are elevated to local privilege escalation if reclaimed memory is reused with attacker-influenced data, or to kernel crash/denial of service if the dangling pointer is dereferenced directly. Exact impact depends on reclaimability of the slab and the fields referenced.

Impact Assessment

This is a local, high-complexity use-after-free in the kernel cgroup iterator. Confidentiality, integrity, and availability impacts are high if the freed task_struct is reused, since the caller holds a dangling reference. The attack requires local access and winning a race, so the practical blast radius is limited to systems where an unprivileged local user can trigger cgroup iteration concurrently with process exit. Multi-tenant hosts, containerized workloads, and shared build/CI systems carry the greatest exposure. There is no exploit-in-the-wild evidence, no KEV entry, and no public PoC.

Detection Guidance

Detection centers on anomalous cgroup enumeration patterns, abnormal kernel crash signatures referencing task_struct/cgroup iterator paths, and KASAN use-after-free reports. Because the race is timing-dependent, detection engineering focuses on kernel telemetry and crash correlation rather than network signatures.

Sigma Rule

title: Suspected cgroup Dying Task Race Trigger Attempts
id: 8c3f4a10-9b2e-4c6a-9d1f-cve202698163
status: experimental
description: Detects repeated enumeration of cgroup tasks concurrent with rapid process termination, consistent with attempted triggering of CVE-2026-98163.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-98163
author: valtersit.com
logsource:
  product: linux
  service: auditd
detection:
  selection_proc:
    type: 'EXECVE'
    exe: '/usr/bin/cat'
  selection_path:
    type: 'PATH'
    name|contains: '/cgroup'
  selection_kill:
    type: 'SYSCALL'
    syscall: 'kill'
  timeframe: 10s
  condition: selection_proc and selection_path or selection_kill
falsepositives:
  - Legitimate container orchestration and monitoring agents
level: low

YARA Rule

rule CVE_2026_98163_cgroup_dying_task_uaf
{
    meta:
        description = "Detects strings associated with cgroup dying task iteration handling in Linux kernel source"
        cve = "CVE-2026-98163"
        author = "valtersit.com"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-98163"
    strings:
        $s1 = "css_task_iter_next"
        $s2 = "dying_tasks"
        $s3 = "cgroup_task_free"
        $s4 = "CSS_TASK_ITER_WITH_DEAD"
    condition:
        2 of them
}

Suricata IDS Rule

alert tcp $HOME_NET any -> $HOME_NET any (msg:"CVE-2026-98163 cgroup Use-After-Free race reconnaissance (cgroup-task enumeration)"; flow:to_server,established; content:"/sys/fs/cgroup"; http_uri; nocase; content:"tasks"; http_uri; nocase; threshold:type both, track by_src, count 100, seconds 10; reference:cve,2026-98163; classtype:attempted-recon; sid:202698163; rev:1;)

Note: This kernel race condition has no directly observable network artifact; the rule above targets file-service/HTTP exposure of cgroup task enumeration in containerized environments as a low-fidelity proxy.

Elastic Detection

process where event.type == "start" and process.name in ("cat", "ps", "systemctl") and
  (process.args : "*cgroup*" or process.args : "*tasks*")

Splunk SPL Query

index=linux sourcetype=auditd (type=SYSCALL syscall=kill OR syscall=clone3)
| transaction host maxspan=5s
| where eventcount > 50
| stats count by host, exe, syscall
| where count > 100

Wazuh OSSEC Rule

<group name="cve_2026_98163,cgroup,">
  <rule id="200981" level="7">
    <decoded_as>json</decoded_as>
    <field name="audit.type">SYSCALL</field>
    <field name="audit.syscall">kill</field>
    <description>CVE-2026-98163: rapid task termination possibly racing cgroup dying_tasks iteration</description>
    <mitre>
      <id>T1068</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source).

1. Immediate mitigations:

• Restrict local interactive and unprivileged access on affected hosts: enforce least privilege, avoid untrusted local users/build jobs on shared kernels.
• Limit container-within-container and hostile multi-tenant co-residency on kernels carrying the introducing commit.
• Monitor for kernel Oops/KASAN reports mentioning task_struct, cgroup iterators, or __put_task_struct_rcu_cb(); correlate with process churn.

2. Patch/upgrade steps:

• Track the upstream Linux kernel fix commit that adds a ->usage==0 check in css_task_iter_next() to skip de-used dying_list tasks. Apply once a stable backport is reported for your distribution.
• Subscribe to your distro's kernel security advisories (e.g., RHSA, USN, Debian DSA) for the eventual CVE mapping.
• Validate the introducing commit 260fbcb92bbea is not present (or is superseded) on deployed kernels before declaring remediation.

3. Long-term hardening:

• Maintain a coordinated kernel patch cadence; do not run kernels pinned to commit ranges carrying this change.
• Deploy runtime kernel integrity protection and KASAN-enabled build fleets in CI/staging to surface UAF races before production.
• Reduce the local attack surface via mandatory access control (SELinux/AppArmor) and narrow capabilities for untrusted workloads.

References

• NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-98163
• Linux kernel cgroup subsystem documentation and upstream commit history (commit 260fbcb92bbea introducing the extended dying_tasks lifetime)
• Kernel Self Protection Project — use-after-free mitigations (KASAN, SLAB_FREELIST_HARDENED)
• CISA KEV catalog — CVE-2026-98163 is NOT listed as of this report
• No public Proof-of-Concept, Nuclei template, or exploit code available at time of writing