VulnerabilityPublished 18 Oct 2026

CVE-2026-98536: Linux kernel · writeback: report a Tasks-RCU quiescent state per cgwb drain pass

Affects Linux kernelSource CVE Database V5

Not known to be exploited · fixed in fd3bf32279df98751364b3609eb100a3e42f253b : patch Linux kernel soon.

Data as of 26 Oct 2026, 14:05 UTC

Severity

High

Rated High by Threat Radar's AI analysis · CVSS not yet scored by NVD

EPSS: 0.2% chance of exploitation in 30 days – higher than 11% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
Patch: Available – fixed in fd3bf32279df98751364b3609eb100a3e42f253b, ebf1555ad2821be06f87a88ffd9a2cab8d2200e1, 863049b4018237d1590cd13b16e9fe9c0faad2c6 +4

Exploitation evidence

Disclosed: evidence found.
CVE published 18 Oct 2026
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors

A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 26 Oct 2026.

Disclosed: The CVE record is public on cve.org. Its publication is t = 0.
Detectable: A public nuclei template can find exposed instances, for defenders and attackers alike.
Weaponised: Public exploit code exists in Metasploit or Exploit-DB, or CISA SSVC or the CVSS exploit maturity reports a public proof of concept.
Exploited in the wild: CISA KEV lists it, CISA SSVC rates exploitation active, or a source reports attacks.
Observed by OffSeq Mirage: OffSeq Mirage honeypot sensors recorded attack traffic for this CVE, or found exposed hosts without attack traffic.

Moments are spaced evenly, not to scale; a dashed line marks a gap of six months or more. Deltas count from t = 0. Sources that give only a date (CISA KEV, Exploit-DB, or a time of exactly 00:00Z) read “same day” rather than hours. Metasploit modules carry the flaw’s disclosure date, not their release date, and nuclei templates carry no date, so both appear above but not on the timeline.

What to do

Upgrade to a fixed release listed under Affected software.

Affected software

Product	Affected	Fixed in
LinuxLinux	Affected ≥ c22d70a162d3cc177282c4487be4d54876ca55c8, < fd3bf32279df98751364b3609eb100a3e42f253b	Fixed in fd3bf32279df98751364b3609eb100a3e42f253b
LinuxLinux	Affected ≥ c22d70a162d3cc177282c4487be4d54876ca55c8, < ebf1555ad2821be06f87a88ffd9a2cab8d2200e1	Fixed in ebf1555ad2821be06f87a88ffd9a2cab8d2200e1
LinuxLinux	Affected ≥ c22d70a162d3cc177282c4487be4d54876ca55c8, < 863049b4018237d1590cd13b16e9fe9c0faad2c6	Fixed in 863049b4018237d1590cd13b16e9fe9c0faad2c6
LinuxLinux	Affected ≥ c22d70a162d3cc177282c4487be4d54876ca55c8, < 42462b5bb0dec57db7f85d0f77655c737d45754d	Fixed in 42462b5bb0dec57db7f85d0f77655c737d45754d
LinuxLinux	Affected ≥ c22d70a162d3cc177282c4487be4d54876ca55c8, < 407a5d205179a4ab186571b0e16ec42725dc77bc	Fixed in 407a5d205179a4ab186571b0e16ec42725dc77bc
LinuxLinux	Affected ≥ c22d70a162d3cc177282c4487be4d54876ca55c8, < 260f586a80e7f624dd7f069898a75a904f34d373	Fixed in 260f586a80e7f624dd7f069898a75a904f34d373

AI-suggested

A fix has been implemented in the Linux kernel source as indicated by multiple fixed commit hashes. Users should update to a kernel version including these fixes to resolve the issue. No additional mitigation is required once the fixed kernel is deployed.

Description

CVE-2026-98536 is a Linux kernel vulnerability affecting version 5.14 where a long-running writeback drain loop on certain kernel configurations can cause a system hang and panic. The issue arises because the kernel does not properly report a Tasks-RCU quiescent state during the drain loop under specific preemption modes, leading to stalled tasks and potential host panic. The flaw was fixed by ensuring the kernel calls cond_resched_tasks_rcu_qs() during the drain loop to avoid stalling synchronize_rcu_tasks() callers.

Impact

The vulnerability can cause prolonged system stalls and eventual kernel panic on affected Linux kernels (notably 5.14) running on architectures with PREEMPT_LAZY preemption modes. This occurs when draining large cgroup writeback domains, leading to blocked BPF or ftrace detach operations and many tasks stuck in D state. The system hang and panic impact availability and stability but does not indicate privilege escalation or data corruption.

Summary

This vulnerability in the Linux kernel's writeback subsystem involves the cleanup_offline_cgwbs_workfn() function draining a dying cgroup writeback (cgwb) domain. On kernels configured with CONFIG_PREEMPTION and PREEMPT_LAZY modes (notably on arm64 and x86 architectures), the drain loop fails to report a Tasks-RCU quiescent state due to cond_resched() being effectively disabled. This causes long-running drain loops to stall synchronize_rcu_tasks() calls, which can block BPF or ftrace detach operations, leading to many tasks stuck in uninterruptible sleep (D state) and eventually triggering a kernel panic due to the hung task detector. The fix involves calling cond_resched_tasks_rcu_qs() within the drain loop to properly report quiescent states and prevent stalls.

References

Community reviews

Loading reviews…

Exploitation evidence

What to do

Affected software

Description

AI analysisMachine-generated, updated 26 Oct 2026, 10:53 UTC

Technical details

References

Community reviews

Related threats