Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%
Buy Us a Coffee

CVE-2026-74594— sched/psi: Shut down rtpoll_timer in psi_cgroup_free()

Quick assessment

Affected
Linux Linux
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

在 Linux 内核中，以下漏洞已修复： sched/psi：在 中关闭 rtpoll_timer 从调度器热路径（hotpath）中以无锁方式调用，可能与 发生竞争。后者会在持有 的情况下销毁最后一个 触发器： 此时，若重新激活的定时器仍处于待处理状态，该 cgroup 组即可被释放，导致 在已释放的内存上执行。 早期提交 （“psi: 从 psi 触发器调度机制中移除 kthread_worker”）在 之后同步删除了定时器，这虽然防止了上述竞争，却引入了与触发器创建过程的竞争：删除操作可能取消在宽限期（gra

AI Predicted 7.8 Difficulty: Moderate EPSS 0.21% · P12

Possible ATT&CK Techniques 1 AI

T1068 · Exploitation for Privilege Escalation

Affected Version Matrix 23

VendorProduct Version RangeStatus
Linux Linux 6bfcb6178925b1fd28c102e53d403091b8f49396< 4addb102154b7cf6e2310ccbe20c3c08619e520d affected
8f91efd870ea5d8bc10b0fcc9740db51cd4c0c83< 894a9300d7fb2e2951da92e565ae6de7ddfb0a69 affected
8f91efd870ea5d8bc10b0fcc9740db51cd4c0c83< 1e5ca82eee59caca6988f9d6e859786aab8a5fa0 affected
8f91efd870ea5d8bc10b0fcc9740db51cd4c0c83< 310b5a537a78c358a4cd244bd767c1a517a05459 affected
8f91efd870ea5d8bc10b0fcc9740db51cd4c0c83< 806fcff98c1d7cb3c1dc0015e55ebdbe819e6b08 affected
8f91efd870ea5d8bc10b0fcc9740db51cd4c0c83< 8037c5b2b2a447df52542f4d8535895d837bdcbd affected
8f91efd870ea5d8bc10b0fcc9740db51cd4c0c83< 611e7821c4f83a671455658797336faecc3a5196 affected
8f91efd870ea5d8bc10b0fcc9740db51cd4c0c83< 5457025fa8ca3c0d2732109513de839e3e797190 affected
… +15 more rows
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-74594

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
sched/psi: Shut down rtpoll_timer in psi_cgroup_free()
Source: CVE Program / CVE List V5
Vulnerability Description
In the Linux kernel, the following vulnerability has been resolved: sched/psi: Shut down rtpoll_timer in psi_cgroup_free() psi_schedule_rtpoll_work() is called locklessly from the scheduler hotpath and can race psi_trigger_destroy() taking down the last rtpoll trigger under rtpoll_trigger_lock: psi_schedule_rtpoll_work() psi_trigger_destroy() rcu_read_lock(); task = rcu_dereference(rtpoll_task); rcu_assign_pointer(rtpoll_task, NULL); timer_delete(&rtpoll_timer); mod_timer(&rtpoll_timer, ...); rcu_read_unlock(); synchronize_rcu(); kthread_stop(task_to_destroy); The group can then be freed with the re-armed timer still pending, and poll_timer_fn() runs on freed memory. 461daba06bdc ("psi: eliminate kthread_worker from psi trigger scheduling mechanism") deleted the timer synchronously after the synchronize_rcu(), which prevented this but raced trigger creation instead: the deletion could cancel the timer that a new trigger set armed during the grace period and, as creation also reinitialized the timer at the time, corrupt it. 8f91efd870ea ("psi: Fix race between psi_trigger_create/destroy") moved the initialization into group_init() and the deletion into the locked section, trading the creation races for the window above. Neither placement in the destruction path works. A pending timer firing while the group is alive is harmless though. poll_timer_fn() just wakes the rtpoll waitqueue and doesn't re-arm itself. Bind the timer to the group's lifetime instead and shut it down in psi_cgroup_free(). Nothing can arm it by then. timer_shutdown_sync() because the timer is never armed again.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
Linux Linux 6bfcb6178925b1fd28c102e53d403091b8f49396 ~ 4addb102154b7cf6e2310ccbe20c3c08619e520d -
Linux Linux 5.14 -

II. Public POCs for CVE-2026-74594

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-74594

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-74594 (8)

Same Patch Batch · Linux · 2026-08-22 · 150 CVEs total

CVE-2026-74640 ALSA: FCP: fix OOB write in fcp_meter_ctl_get()
CVE-2026-74622 net: atlantic: free RX pages of consumed but not refilled buffers
CVE-2026-74623 net: atlantic: free stranded TX buffers on ring deinit
CVE-2026-74624 netfilter: nf_conntrack: defer invalid log until after unlock
CVE-2026-74625 netfilter: bridge: release template ct on non-IP path
CVE-2026-74627 net: devmem: prevent net-iov / page mixing
CVE-2026-74626 NTB: ntb_netdev: Preserve RX queue depth on allocation failure
CVE-2026-74628 net/x25: fix use-after-free of the socket by its timers
CVE-2026-74629 net/dibs: Correct freeing of dmb_clientid_arr
CVE-2026-74631 net: smc: fix splice entry lifetime imbalance in smc_rx_splice
CVE-2026-74630 ipv6: prevent in6_dev_get() from resurrecting inet6_dev
CVE-2026-74632 mm/huge_memory: fix huge_zero_pfn race
CVE-2026-74633 tracing: Fix NULL pointer dereference in module event cache removal
CVE-2026-74634 ring-buffer: Prevent subbuf order change when resizing is disabled
CVE-2026-74635 fbdev: bitblit: bound-check glyph index in bit_cursor()
CVE-2026-74636 tracing: Fix race between update_event_fields and, event_define_fields
CVE-2026-74637 perf/core: Fix group leader use-after-free after sibling detach
CVE-2026-74639 ALSA: us144mkii: re-anchor capture URBs on resubmission
CVE-2026-74638 drm/v3d: Serialize the scheduler timeout handlers
CVE-2026-74651 staging: rtl8723bs: fix OOB read in rtw_get_wpa_ie()

Showing top 20 of 150 CVEs. View all on vendor page &rarr; →

IV. Related Vulnerabilities

Same product: Linux
Same vendor: Linux

V. Comments for CVE-2026-74594

No comments yet

Leave a comment