CVE-2026-99065: cgroup/cpuset: Handle cpu hotplug race in guarantee_active_cpus()

In the Linux kernel, the following vulnerability has been resolved:

cgroup/cpuset: Handle cpu hotplug race in guaranteeactivecpus()

With commit 2125c0034c5d ("cgroup/cpuset: Make cpuset hotplug processing synchronous"), the cpuset hotplug operation becomes synchronous. That commit also removes the code that handles race between cpusethotplugwork and cpu hotplug notifier with the assumption that race is now gone. Later commit 7a0aabd9ce69 ("cgroup/cpuset: Always use cpuactivemask") updates the cpuset code to always use cpuactivemask instead of cpuonlinemask in some places including guaranteeonlinecpus() which is renamed to guaranteeactivecpus() in that commit.

In the case of CPU offline operation, cpuactivemask is updated first in schedcpudeactivate() to remove the offline CPU before cpusethandlehotplug() is called to update the effectivecpus of the affected cpusets. The cpuonlinemask is updated after that near the end of the offline operation to remove the offline CPU. As a result, the race comes back and the top cpuset may not have any active CPU leading to NULL pointer dereference during the race window when guaranteeactivecpus() is called after cpuactivemask is updated to remove the CPU to be torn down but before cpusethandlehotplug() is able to properly update the effectivecpus of the top cpuset.

Fix this by adding back the NULL cs check to avoid this problem.