SB2026102393 - NULL pointer dereference in Linux kernel cgroup

Description

This security bulletin contains information about 1 vulnerability.

1) NULL pointer dereference (CVE-ID: CVE-2026-99065)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service through a kernel NULL pointer dereference.

The vulnerability exists due to a race condition leading to a NULL pointer dereference in the Linux kernel cpuset function guarantee_active_cpus() when CPU offlining updates cpu_active_mask before cpuset_handle_hotplug() updates the affected cpusets' effective_cpus masks. A local user can potentially trigger a call to guarantee_active_cpus() during this race window to cause a kernel crash when traversal beyond the top cpuset results in dereferencing a NULL pointer.

Remediation

Install update from vendor's website.

References

• https://git.kernel.org/stable/c/23b1ab15ca91f2cffaf149d9bb0fafeb700c7db2
• https://git.kernel.org/stable/c/8d88d3221204fbb1b6dc2c0f2f2181fe49126639
• https://git.kernel.org/stable/c/a21c255159bfe0034740292e10d2e258feeeb10d