This vulnerability in the Linux kernel involves a race condition between cgroup_writeback_umount() and inode_switch_wbs()/cleanup_offline_cgwb() functions. When a container exits, a kernel BUG_ON() may be triggered due to busy inodes after unmounting an ext4 filesystem. The race occurs because there is a window between inode_prepare_wbs_switch() returning true and the subsequent wb_queue_isw() call, leading to a use-after-free scenario during inode reference counting and eviction. The fix involves extending the RCU read-side critical section to cover the entire window and adding a synchronize_rcu() call in cgroup_writeback_umount() to ensure all in-flight switchers complete before flush_workqueue() is called. This fix is designed to be backported to stable kernels and removes the race condition without impacting normal operation.

The vulnerability can cause kernel crashes (BUG_ON) due to busy inodes after unmount, which may lead to system instability or denial of service. The root cause is a race condition that can result in use-after-free during inode reference handling in the writeback subsystem. There is no indication of privilege escalation or data corruption beyond system instability. No known exploits in the wild have been reported.

A fix for this race condition has been implemented in the Linux kernel by extending RCU critical sections and adding synchronization calls to ensure proper ordering during unmount operations. Users should apply the official kernel updates that include this fix. Since no affected versions or patch links are provided, check the vendor or Linux kernel mailing lists for the relevant stable kernel updates (including 5.10.y, 6.6.y, and later). Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.