Use-after-free in Linux kernel - CVE-2026-52991

Vulnerability identifier: #VU135393

CSH Severity: Low

CVSS v4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2026-52991

CWE-ID: CWE-416

Exploitation vector: Local access

Exploit availability: No public exploit available

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in pressure_write() in kernel/cgroup/cgroup.c when handling a write to a pressure cgroup file during concurrent cgroup file release. A local user can write crafted pressure data while racing cgroup file release to cause a denial of service.

The issue occurs because the of->priv pointer may be freed concurrently and later dereferenced.

Linux kernel
Red Hat Enterprise Linux for Real Time
Red Hat Enterprise Linux for Real Time for NFV
Anolis OS
openEuler
Ubuntu
kernel-rt (Red Hat package)
kernel-devel
bpftool
kernel
kernel-core
kernel-cross-headers
kernel-debug
kernel-debug-core
kernel-debug-devel
kernel-debug-modules
kernel-debug-modules-extra
kernel-headers
kernel-modules
kernel-modules-extra
kernel-tools
kernel-tools-libs
kernel-tools-libs-devel
perf
python3-perf
kernel-abi-stablelists
kernel-doc
bpftool-debuginfo
kernel-tools-debuginfo
kernel-tools-devel
perf-debuginfo
python3-perf-debuginfo
kernel-debugsource
kernel-debuginfo
kernel-source
kernel-extra-modules
linux (Ubuntu package)
linux-ibm (Ubuntu package)
linux-oem-7.0 (Ubuntu package)
linux-aws (Ubuntu package)
linux-azure (Ubuntu package)
linux-gcp-7.0 (Ubuntu package)
linux-nvidia (Ubuntu package)
linux-nvidia-bos (Ubuntu package)

Install security update from vendor's repository.

Linux kernel - update to 7.0 rc3
kernel-rt (Red Hat package) - update to 4.18.0-553.157.1.rt7.498.el8_10
kernel-devel - update to 4.18.0-553.157.1.0.1
bpftool - update to 4.18.0-553.157.1.0.1
kernel - update to 4.18.0-553.157.1.0.1
kernel-core - update to 4.18.0-553.157.1.0.1
kernel-cross-headers - update to 4.18.0-553.157.1.0.1
kernel-debug - update to 4.18.0-553.157.1.0.1
kernel-debug-core - update to 4.18.0-553.157.1.0.1
kernel-debug-devel - update to 4.18.0-553.157.1.0.1
kernel-debug-modules - update to 4.18.0-553.157.1.0.1
kernel-debug-modules-extra - update to 4.18.0-553.157.1.0.1
kernel-headers - update to 4.18.0-553.157.1.0.1
kernel-modules - update to 4.18.0-553.157.1.0.1
kernel-modules-extra - update to 4.18.0-553.157.1.0.1
kernel-tools - update to 4.18.0-553.157.1.0.1
kernel-tools-libs - update to 4.18.0-553.157.1.0.1
kernel-tools-libs-devel - update to 4.18.0-553.157.1.0.1
perf - update to 4.18.0-553.157.1.0.1
python3-perf - update to 4.18.0-553.157.1.0.1
kernel-abi-stablelists - update to 4.18.0-553.157.1.0.1
kernel-doc - update to 4.18.0-553.157.1.0.1
bpftool - addressed in versions 5.10.0-323.0.0.224, 6.6.0-145.1.20.157, 6.6.0-145.3.26.157
kernel-headers - addressed in versions 5.10.0-323.0.0.224, 6.6.0-145.1.20.157, 6.6.0-145.3.26.157
bpftool-debuginfo - addressed in versions 5.10.0-323.0.0.224, 6.6.0-145.1.20.157, 6.6.0-145.3.26.157
kernel-tools - addressed in versions 5.10.0-323.0.0.224, 6.6.0-145.1.20.157, 6.6.0-145.3.26.157
kernel-tools-debuginfo - addressed in versions 5.10.0-323.0.0.224, 6.6.0-145.1.20.157, 6.6.0-145.3.26.157
kernel-tools-devel - addressed in versions 5.10.0-323.0.0.224, 6.6.0-145.1.20.157, 6.6.0-145.3.26.157
perf - addressed in versions 5.10.0-323.0.0.224, 6.6.0-145.1.20.157, 6.6.0-145.3.26.157
perf-debuginfo - addressed in versions 5.10.0-323.0.0.224, 6.6.0-145.1.20.157, 6.6.0-145.3.26.157
python3-perf - addressed in versions 5.10.0-323.0.0.224, 6.6.0-145.1.20.157, 6.6.0-145.3.26.157
python3-perf-debuginfo - addressed in versions 5.10.0-323.0.0.224, 6.6.0-145.1.20.157, 6.6.0-145.3.26.157
kernel-devel - addressed in versions 5.10.0-323.0.0.224, 6.6.0-145.1.20.157, 6.6.0-145.3.26.157
kernel-debugsource - addressed in versions 5.10.0-323.0.0.224, 6.6.0-145.1.20.157, 6.6.0-145.3.26.157
kernel-debuginfo - addressed in versions 5.10.0-323.0.0.224, 6.6.0-145.1.20.157, 6.6.0-145.3.26.157
kernel - addressed in versions 5.10.0-323.0.0.224, 6.6.0-145.1.20.157, 6.6.0-145.3.26.157
kernel-source - addressed in versions 5.10.0-323.0.0.224, 6.6.0-145.1.20.157, 6.6.0-145.3.26.157
kernel-extra-modules - update to 6.6.0-145.3.26.157
linux (Ubuntu package) - addressed in versions 7.0.0-28.28, 7.0.0-28.28.1, 7.0.0-1003.4, 7.0.0-1008.8
linux-ibm (Ubuntu package) - addressed in versions 7.0.0-1008.8, 7.0.0-1010.10
linux-oem-7.0 (Ubuntu package) - update to 7.0.0-1009.9
linux-aws (Ubuntu package) - addressed in versions 7.0.0-1009.9, 7.0.0-1015.15
linux-azure (Ubuntu package) - addressed in versions 7.0.0-1009.9, 7.0.0-1010.10
linux-gcp-7.0 (Ubuntu package) - update to 7.0.0-1011.11~24.04.1
linux-nvidia (Ubuntu package) - addressed in versions 7.0.0-1016.16, 7.0.0-1016.16~24.04.1
linux-nvidia-bos (Ubuntu package) - update to 7.0.0-2016.16

• https://git.kernel.org/stable/c/03dc070fa0fc3cb4068693f468ccd5f8a7e58282
• https://git.kernel.org/stable/c/a5b98009f16d8a5fb4a8ff9a193f5735515c38fa
• https://git.kernel.org/stable/c/d4352c0709bfd38c752fccbde7fd72a82ac78f23

• Use-after-free in Linux kernel cgroup
• openEuler 22.03 LTS SP4 update for kernel
• Ubuntu update for linux-oem-7.0
• Ubuntu update for linux
• Ubuntu update for linux-ibm
• Ubuntu update for linux-azure
• Ubuntu update for linux-aws
• openEuler 24.03 LTS SP1 update for kernel
• Red Hat Enterprise Linux 8 update for kernel-rt
• openEuler 24.03 LTS SP3 update for kernel
• Ubuntu update for linux-nvidia-bos
• Ubuntu update for linux-nvidia
• Anolis OS update for kernel:4.18
• Ubuntu update for linux-gcp-7.0