---
id: CVE-2026-99065
title: 'cgroup/cpuset: Handle cpu hotplug race in guarantee_active_cpus()'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  cgroup/cpuset: Handle cpu hotplug race in guarantee_active_cpus()

  With commit 2125c0034c5d ("cgroup/cpuset: Make cpuset hotplug processing
  synchronous"), the cpuset ho…
severity: none
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 7a0aabd9ce697fc581ec691b21f748050fbcf004 <
    8d88d3221204fbb1b6dc2c0f2f2181fe49126639
  - >-
    Linux >= 7a0aabd9ce697fc581ec691b21f748050fbcf004 <
    a21c255159bfe0034740292e10d2e258feeeb10d
  - >-
    Linux >= 7a0aabd9ce697fc581ec691b21f748050fbcf004 <
    23b1ab15ca91f2cffaf149d9bb0fafeb700c7db2
  - Linux 6.16
published: '2026-10-23'
updated: '2026-10-23'
sourceUpdated: '2026-10-23T12:23:08.458Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-99065'
references:
  - url: 'https://git.kernel.org/stable/c/8d88d3221204fbb1b6dc2c0f2f2181fe49126639'
  - url: 'https://git.kernel.org/stable/c/a21c255159bfe0034740292e10d2e258feeeb10d'
  - url: 'https://git.kernel.org/stable/c/23b1ab15ca91f2cffaf149d9bb0fafeb700c7db2'
tags:
  - cve.org
ingestedAt: '2026-10-23T13:24:55.518Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

cgroup/cpuset: Handle cpu hotplug race in guarantee_active_cpus()

With commit 2125c0034c5d ("cgroup/cpuset: Make cpuset hotplug processing
synchronous"), the cpuset hotplug operation becomes synchronous. That
commit also removes the code that handles race between cpuset_hotplug_work
and cpu hotplug notifier with the assumption that race is now gone.
Later commit 7a0aabd9ce69 ("cgroup/cpuset: Always use cpu_active_mask")
updates the cpuset code to always use cpu_active_mask instead of
cpu_online_mask in some places including guarantee_online_cpus() which
is renamed to guarantee_active_cpus() in that commit.

In the case of CPU offline operation, cpu_active_mask is updated
first in sched_cpu_deactivate() to remove the offline CPU before
cpuset_handle_hotplug() is called to update the effective_cpus of the
affected cpusets. The cpu_online_mask is updated after that near the end
of the offline operation to remove the offline CPU. As a result, the race
comes back and the top cpuset may not have any active CPU leading to NULL
pointer dereference during the race window when guarantee_active_cpus()
is called after cpu_active_mask is updated to remove the CPU to be torn
down but before cpuset_handle_hotplug() is able to properly update the
effective_cpus of the top cpuset.

Fix this by adding back the NULL cs check to avoid this problem.

## Affected

- `Linux >= 7a0aabd9ce697fc581ec691b21f748050fbcf004 < 8d88d3221204fbb1b6dc2c0f2f2181fe49126639`
- `Linux >= 7a0aabd9ce697fc581ec691b21f748050fbcf004 < a21c255159bfe0034740292e10d2e258feeeb10d`
- `Linux >= 7a0aabd9ce697fc581ec691b21f748050fbcf004 < 23b1ab15ca91f2cffaf149d9bb0fafeb700c7db2`
- `Linux 6.16`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.