CVE-2026-74594: sched/psi: Shut down rtpoll_timer in psi_cgroup_free()

From: Greg Kroah-Hartman <[email protected]>

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

sched/psi: Shut down rtpoll_timer in psi_cgroup_free()

psi_schedule_rtpoll_work() is called locklessly from the scheduler hotpath
and can race psi_trigger_destroy() taking down the last rtpoll trigger under
rtpoll_trigger_lock:

  psi_schedule_rtpoll_work()        psi_trigger_destroy()

  rcu_read_lock();
  task = rcu_dereference(rtpoll_task);
                                    rcu_assign_pointer(rtpoll_task, NULL);
                                    timer_delete(&rtpoll_timer);
  mod_timer(&rtpoll_timer, ...);
  rcu_read_unlock();
                                    synchronize_rcu();
                                    kthread_stop(task_to_destroy);

The group can then be freed with the re-armed timer still pending, and
poll_timer_fn() runs on freed memory.

461daba06bdc ("psi: eliminate kthread_worker from psi trigger scheduling
mechanism") deleted the timer synchronously after the synchronize_rcu(),
which prevented this but raced trigger creation instead: the deletion could
cancel the timer that a new trigger set armed during the grace period and,
as creation also reinitialized the timer at the time, corrupt it.
8f91efd870ea ("psi: Fix race between psi_trigger_create/destroy") moved the
initialization into group_init() and the deletion into the locked section,
trading the creation races for the window above.

Neither placement in the destruction path works. A pending timer firing
while the group is alive is harmless though. poll_timer_fn() just wakes the
rtpoll waitqueue and doesn't re-arm itself. Bind the timer to the group's
lifetime instead and shut it down in psi_cgroup_free(). Nothing can arm it
by then. timer_shutdown_sync() because the timer is never armed again.

The Linux kernel CVE team has assigned CVE-2026-74594 to this issue.


Affected and fixed versions
===========================

	Issue introduced in 5.14 with commit 8f91efd870ea5d8bc10b0fcc9740db51cd4c0c83 and fixed in 6.1.183 with commit 1e5ca82eee59caca6988f9d6e859786aab8a5fa0
	Issue introduced in 5.14 with commit 8f91efd870ea5d8bc10b0fcc9740db51cd4c0c83 and fixed in 6.6.152 with commit 310b5a537a78c358a4cd244bd767c1a517a05459
	Issue introduced in 5.14 with commit 8f91efd870ea5d8bc10b0fcc9740db51cd4c0c83 and fixed in 6.12.104 with commit 806fcff98c1d7cb3c1dc0015e55ebdbe819e6b08
	Issue introduced in 5.14 with commit 8f91efd870ea5d8bc10b0fcc9740db51cd4c0c83 and fixed in 6.18.45 with commit 8037c5b2b2a447df52542f4d8535895d837bdcbd
	Issue introduced in 5.14 with commit 8f91efd870ea5d8bc10b0fcc9740db51cd4c0c83 and fixed in 7.1.9 with commit 611e7821c4f83a671455658797336faecc3a5196
	Issue introduced in 5.14 with commit 8f91efd870ea5d8bc10b0fcc9740db51cd4c0c83 and fixed in 7.2 with commit 5457025fa8ca3c0d2732109513de839e3e797190
	Issue introduced in 5.10.50 with commit 6bfcb6178925b1fd28c102e53d403091b8f49396
	Issue introduced in 5.12.17 with commit e1e5e263bbe0e6e9c3db36aa48a3c8acf546fa49
	Issue introduced in 5.13.2 with commit 979965c33f734a1666af67900408f997ac669c23

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2026-74594
will be updated if fixes are backported, please check that for the most
up to date information about this issue.


Affected files
==============

The file(s) affected by this issue are:
	kernel/sched/psi.c


Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/1e5ca82eee59caca6988f9d6e859786aab8a5fa0
	https://git.kernel.org/stable/c/310b5a537a78c358a4cd244bd767c1a517a05459
	https://git.kernel.org/stable/c/806fcff98c1d7cb3c1dc0015e55ebdbe819e6b08
	https://git.kernel.org/stable/c/8037c5b2b2a447df52542f4d8535895d837bdcbd
	https://git.kernel.org/stable/c/611e7821c4f83a671455658797336faecc3a5196
	https://git.kernel.org/stable/c/5457025fa8ca3c0d2732109513de839e3e797190