UBUNTU-CVE-2026-98972: Medium severity ubuntu/linux-azure vulnerability
In the Linux kernel, the following vulnerability has been resolved: cgroup/cpuset: Don't access cpusetcgrpsubsys.root in isinv2mode() After seeing the patch [1] to guard isinv2mode() with RCU, it makes me realize that isinv2mode() may be called in a context where a new cgroup filesystem is being rebound with stale cpusetcgrpsubsys.root pointer. Avoid this potential UaF situation by adding a new cpusetv2mode flag which is set when the cpusetv2mode mount option is used. This flag is written into only when cpusetbind() is being called with a stable cpusetcgrpsubsys.root value. The isinv2mode() helper is modified to read the new cpusetv2mode flag instead of accessing cpusetcgrpsubsys.root directly. [1] https://lore.kernel.org/lkml/20260929084124.626693-2-arighi@nvidia.com
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/linux-aws-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.18~24.04.1 - Upgrade
Upgrade
ubuntu/linux-azure-fde-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1019.19~24.04.1 - Upgrade
Upgrade
ubuntu/linux-gcp-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.19~24.04.1 - Upgrade
Upgrade
ubuntu/linux-oracle-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1016.18~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-43.43.1~24.04.2 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.3.0-10.10 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.3.0-1004.4 - Upgrade
Upgrade
ubuntu/linux-azureto a version that resolves this vulnerability.Fixed in 7.3.0-1004.4 - Upgrade
Upgrade
ubuntu/linux-azure-fdeto a version that resolves this vulnerability.Fixed in 7.3.0-1004.5 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.3.0-1004.4 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.3.0-1004.4 - Upgrade
Upgrade
ubuntu/linux-raspito a version that resolves this vulnerability.Fixed in 7.3.0-1004.4 - Upgrade
Upgrade
ubuntu/linux-realtimeto a version that resolves this vulnerability.Fixed in 7.3.0-10.10.1 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.3.0-10.10.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-43.43 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1017.18 - Upgrade
Upgrade
ubuntu/linux-azureto a version that resolves this vulnerability.Fixed in 7.0.0-1020.21 - Upgrade
Upgrade
ubuntu/linux-azure-fdeto a version that resolves this vulnerability.Fixed in 7.0.0-1019.19 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1017.19 - Upgrade
Upgrade
ubuntu/linux-gketo a version that resolves this vulnerability.Fixed in 7.0.0-1010.11 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1018.18 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1018.18 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1016.18 - Upgrade
Upgrade
ubuntu/linux-raspito a version that resolves this vulnerability.Fixed in 7.0.0-1023.23 - Upgrade
Upgrade
ubuntu/linux-realtimeto a version that resolves this vulnerability.Fixed in 7.0.0-43.43.1 - Configuration
Add and use the cpuset_v2_mode flag: set it during cpuset_bind() when the cpuset_v2_mode mount option is used, and have is_in_v2_mode() read this flag instead of accessing cpuset_cgrp_subsys.root directly.
Linux kernel cgroup/cpuset cpuset_v2_mode = set when the cpuset_v2_mode mount option is used
Event History
Frequently Asked Questions
Which Ubuntu kernel packages are listed as affected?
The listed packages are ubuntu/linux, ubuntu/linux-aws-fips, ubuntu/linux-azure, ubuntu/linux-azure-fips, ubuntu/linux-fips, ubuntu/linux-gcp, ubuntu/linux-gcp-fips, and ubuntu/linux-oracle.
What runtime condition is associated with the unsafe access?
The potential use-after-free condition involves cgroup filesystem rebinding while a stale cpuset_cgrp_subsys.root pointer may be observed. The updated logic uses a cpuset_v2_mode flag set when the cpuset_v2_mode mount option is used, rather than directly reading that root pointer.