AZL-110798: CVE-2026-98972 affecting package kernel 6.6.157.1-1

Q: What condition is required for this issue to occur?

The issue involves a cgroup filesystem being rebound while code calls is_in_v2_mode(). In that situation, the code may use a stale cpuset_cgrp_subsys.root pointer, creating a potential use-after-free condition.

Q: Is use of cgroup v2 relevant to exposure?

Yes. The fix introduces a cpuset_v2_mode flag that is set when the cpuset_v2_mode mount option is used, and is_in_v2_mode() now reads that flag instead of directly accessing the cgroup root pointer.

Q: How can I determine whether the installed Azure Linux kernel package is the affected one?

Check whether the installed package is azure-linux/kernel version 6.6.157.1-1. The provided data identifies that package version as affected.

Published Oct 23, 2026

Updated

In the Linux kernel, the following vulnerability has been resolved:

cgroup/cpuset: Don't access cpusetcgrpsubsys.root in isinv2mode()

After seeing the patch [1] to guard isinv2mode() with RCU, it makes me realize that isinv2mode() may be called in a context where a new cgroup filesystem is being rebound with stale cpusetcgrpsubsys.root pointer. Avoid this potential UaF situation by adding a new cpusetv2mode flag which is set when the cpusetv2mode mount option is used. This flag is written into only when cpusetbind() is being called with a stable cpusetcgrpsubsys.root value. The isinv2mode() helper is modified to read the new cpusetv2mode flag instead of accessing cpusetcgrpsubsys.root directly.

[1] https://lore.kernel.org/lkml/20260929084124.626693-2-arighi@nvidia.com

Affected Software

1 affected component

azure-linux/kernel<=6.6.157.1-1

Event History

Oct 23, 2026

Advisory Published

via OSV·01:17 PM

Data Sourced

via OSV·01:17 PM

DescriptionAffected Software

Child vulnerabilities

Contains the following vulnerabilities.

CVE-2026-98972

Frequently Asked Questions

What condition is required for this issue to occur?

The issue involves a cgroup filesystem being rebound while code calls is_in_v2_mode(). In that situation, the code may use a stale cpuset_cgrp_subsys.root pointer, creating a potential use-after-free condition.

Is use of cgroup v2 relevant to exposure?

Yes. The fix introduces a cpuset_v2_mode flag that is set when the cpuset_v2_mode mount option is used, and is_in_v2_mode() now reads that flag instead of directly accessing the cgroup root pointer.

How can I determine whether the installed Azure Linux kernel package is the affected one?

Check whether the installed package is azure-linux/kernel version 6.6.157.1-1. The provided data identifies that package version as affected.

AZL-110798: CVE-2026-98972 affecting package kernel 6.6.157.1-1

Affected Software

Event History

Child vulnerabilities

Frequently Asked Questions

What condition is required for this issue to occur?

Is use of cgroup v2 relevant to exposure?

How can I determine whether the installed Azure Linux kernel package is the affected one?

Company

Resources

Contact

Frequently Asked Questions

What condition is required for this issue to occur?

Is use of cgroup v2 relevant to exposure?

How can I determine whether the installed Azure Linux kernel package is the affected one?