In the Linux kernel, the following vulnerability has been resolved: cgroup/cpuset: Handle cpu hotplug race in guarantee_active_cpus() With commit… (CVE-2026-99065)

The vulnerability involves a race condition in the Linux kernel's cgroup cpuset code during CPU offline operations. The cpu_active_mask is updated before cpuset_handle_hotplug() adjusts the effective_cpus, while cpu_online_mask is updated later, causing a race where guarantee_active_cpus() may be called when the top cpuset has no active CPU. This leads to a NULL pointer dereference. The fix synchronizes cpuset hotplug processing and adds a NULL check in guarantee_active_cpus() to prevent this issue.

The race condition can cause a NULL pointer dereference in the kernel, potentially leading to a kernel crash (denial of service). No information about privilege escalation or code execution is provided.

A fix has been implemented in the Linux kernel by making cpuset hotplug processing synchronous and adding a NULL pointer check in guarantee_active_cpus(). Users should apply the official kernel updates containing these commits to remediate the issue. Patch status is not explicitly confirmed in the provided data; check the vendor advisory for current remediation guidance.