Linux Kernel EUVD-2026-87544

Requires local access to a host running an affected kernel built with cgroups (effectively all modern Linux), and the ability to read a cgroup.procs file while concurrently creating and exiting multi-threaded process groups. The specific trigger is a dying threadgroup leader (or CSS_TASK_ITER_WITH_DEAD iteration) whose task_struct ->usage count has dropped to zero after cgroup_task_release() but before cgroup_task_free(), during the css_set_lock release window between css_task_iter_next() iterations. Limiting factors: exploitation is purely local (no network vector), needs low-but-nonzero privileges (ability to run tasks and read cgroup.procs), and above all depends on winning a very narrow timing race (AC:H) tied to RCU grace periods and task teardown ordering, making reliable exploitation difficult; default configurations are affected but the race is not deterministically triggerable.

This is a genuine but hard-to-exploit kernel memory-safety flaw, best characterized as high-CVSS/low-real-world-risk for most environments. The provided CVSS 3.1 vector (AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H = 7.0 High) is internally consistent with the description: exploitation is local (AV:L), requires an attacker-controlled task plus an unprivileged read of cgroup.procs (PR:L), and critically depends on winning a narrow race window between css_task_iter_next() invocations (AC:H). All three impact metrics are High because a use-after-free on a freed task_struct can corrupt kernel memory, enabling disclosure, tampering, or a crash. The EPSS score of 0.18% (7th percentile) strongly reinforces low real-world exploitation likelihood, which is fully expected for a race-condition UAF that needs precise timing and a specific lifecycle (a dying threadgroup leader whose refcount reaches zero while still on dying_tasks). The CVE is NOT on CISA KEV and no public PoC is indicated, so EPSS and the absence of KEV agree - there is no signal of active or widespread exploitation. The signals are therefore consistent rather than conflicting: a serious correctness bug with low practical weaponization. Note the input Tags label this 'Information Disclosure', which understates the flaw - the CVSS C:H/I:H/A:H and the UAF mechanism point to full memory corruption, not mere disclosure; treat impact as potential local privilege escalation / kernel crash, not read-only. Priority is driven by exposure to untrusted local users/containers rather than by exploitation probability.

A local unprivileged user (or a process inside a container) continuously reads /sys/fs/cgroup/.../cgroup.procs while repeatedly spawning and exiting multi-threaded process groups, aiming to hit the race where a dying group leader's task_struct refcount drops to zero but it remains on dying_tasks. If the iterator calls get_task_struct() on that zero-refcount task, it resurrects freed memory, producing a use-after-free that can be groomed into kernel memory corruption. No public exploit code is identified at time of analysis, and the high attack complexity (precise race timing) makes reliable exploitation difficult.