---
id: CVE-2026-74594
title: |-
  In the Linux kernel, the following vulnerability has been resolved:

  sched/psi: Shut down rtpoll_timer in psi_cgroup_free()

  psi_schedule_rtpoll_work() is called locklessly from the scheduler hotpath
  and can race psi_trigger_destroy() ta…
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  sched/psi: Shut down rtpoll_timer in psi_cgroup_free()

  psi_schedule_rtpoll_work() is called locklessly from the scheduler hotpath
  and can race psi_trigger_destroy() ta…
severity: high
cvss: 7.8
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'
cwe:
  - CWE-416
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 6bfcb6178925b1fd28c102e53d403091b8f49396 <
    4addb102154b7cf6e2310ccbe20c3c08619e520d
  - >-
    Linux >= 8f91efd870ea5d8bc10b0fcc9740db51cd4c0c83 <
    894a9300d7fb2e2951da92e565ae6de7ddfb0a69
  - >-
    Linux >= 8f91efd870ea5d8bc10b0fcc9740db51cd4c0c83 <
    1e5ca82eee59caca6988f9d6e859786aab8a5fa0
  - >-
    Linux >= 8f91efd870ea5d8bc10b0fcc9740db51cd4c0c83 <
    310b5a537a78c358a4cd244bd767c1a517a05459
  - >-
    Linux >= 8f91efd870ea5d8bc10b0fcc9740db51cd4c0c83 <
    806fcff98c1d7cb3c1dc0015e55ebdbe819e6b08
  - >-
    Linux >= 8f91efd870ea5d8bc10b0fcc9740db51cd4c0c83 <
    8037c5b2b2a447df52542f4d8535895d837bdcbd
  - >-
    Linux >= 8f91efd870ea5d8bc10b0fcc9740db51cd4c0c83 <
    611e7821c4f83a671455658797336faecc3a5196
  - >-
    Linux >= 8f91efd870ea5d8bc10b0fcc9740db51cd4c0c83 <
    5457025fa8ca3c0d2732109513de839e3e797190
  - Linux e1e5e263bbe0e6e9c3db36aa48a3c8acf546fa49
  - Linux 979965c33f734a1666af67900408f997ac669c23
  - Linux >= 5.10.50 < 5.10.266
  - Linux >= 5.12.17 < 5.13
  - Linux >= 5.13.2 < 5.14
  - Linux 5.14
published: '2026-08-22'
updated: '2026-10-16'
sourceUpdated: '2026-10-16T20:17:44.737'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-74594'
references:
  - url: 'https://git.kernel.org/stable/c/1e5ca82eee59caca6988f9d6e859786aab8a5fa0'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/310b5a537a78c358a4cd244bd767c1a517a05459'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/4addb102154b7cf6e2310ccbe20c3c08619e520d'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/5457025fa8ca3c0d2732109513de839e3e797190'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/611e7821c4f83a671455658797336faecc3a5196'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/8037c5b2b2a447df52542f4d8535895d837bdcbd'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/806fcff98c1d7cb3c1dc0015e55ebdbe819e6b08'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/894a9300d7fb2e2951da92e565ae6de7ddfb0a69'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: >-
      https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-74594.json
  - url: 'https://access.redhat.com/security/cve/CVE-2026-74594'
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2521435'
  - url: 'https://www.cve.org/CVERecord?id=CVE-2026-74594'
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-74594'
  - url: 'https://kernelcve.org/list/?q=CVE-2026-74594'
  - url: >-
      https://lore.kernel.org/linux-cve-announce/2026082213-CVE-2026-74594-644a@gregkh/T
tags:
  - nvd
  - cve.org
  - csaf
  - vex
  - red-hat
  - score-dispute
epss: 0.00129
epssPercentile: 0.02546
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-10-16T19:01:40.497794Z'
scores:
  nvd: 7.8
  vendor: 4.7
ingestedAt: '2026-08-23T09:45:33.257Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

sched/psi: Shut down rtpoll_timer in psi_cgroup_free()

psi_schedule_rtpoll_work() is called locklessly from the scheduler hotpath
and can race psi_trigger_destroy() taking down the last rtpoll trigger under
rtpoll_trigger_lock:

  psi_schedule_rtpoll_work()        psi_trigger_destroy()

  rcu_read_lock();
  task = rcu_dereference(rtpoll_task);
                                    rcu_assign_pointer(rtpoll_task, NULL);
                                    timer_delete(&rtpoll_timer);
  mod_timer(&rtpoll_timer, ...);
  rcu_read_unlock();
                                    synchronize_rcu();
                                    kthread_stop(task_to_destroy);

The group can then be freed with the re-armed timer still pending, and
poll_timer_fn() runs on freed memory.

461daba06bdc ("psi: eliminate kthread_worker from psi trigger scheduling
mechanism") deleted the timer synchronously after the synchronize_rcu(),
which prevented this but raced trigger creation instead: the deletion could
cancel the timer that a new trigger set armed during the grace period and,
as creation also reinitialized the timer at the time, corrupt it.
8f91efd870ea ("psi: Fix race between psi_trigger_create/destroy") moved the
initialization into group_init() and the deletion into the locked section,
trading the creation races for the window above.

Neither placement in the destruction path works. A pending timer firing
while the group is alive is harmless though. poll_timer_fn() just wakes the
rtpoll waitqueue and doesn't re-arm itself. Bind the timer to the group's
lifetime instead and shut it down in psi_cgroup_free(). Nothing can arm it
by then. timer_shutdown_sync() because the timer is never armed again.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

## Vendor advisories

- **Red Hat VEX** · Moderate · affected: Red Hat Enterprise Linux 8 · no fix planned: Red Hat Enterprise Linux 8 · updated 2026-10-26 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-74594.json)