CVE-2026-98163 is a high severity (CVSS 7.8) race condition and use after free in the Linux kernel cgroup code, where the task iterator can touch a dying task whose reference count has reached zero. Install a kernel update that includes the fix. Check your distribution for the exact fixed version.
What's affected
The record says the Linux kernel resolved a flaw in the cgroup subsystem. An earlier change extended how long dying tasks stay on the dying tasks list. The iterators that walk this list assumed such a task could always obtain a new reference. The record explains that between a task being released and being freed there is a window in which its usage count may already be zero.
If the iterator moves on to such a task while the lock is released between calls, it could return a task structure that is about to be freed, and later use would then be a use after free. The fix adds a check that rules out tasks with a usage count of zero, with an extra loop that skips them.
The CVSS 3.1 vector is AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, a score of 7.8. A local account is needed. KEV is false. The record cites two stable kernel commits, but kernel.org returned an access error when we tried to read them, so we cannot name the stable releases that carry the fix.
How to check if you're exposed
Check the running kernel with uname -r. The flaw exists only in kernels that contain the earlier change that moved dying task cleanup, so not every kernel version is affected. The record does not list the versions, so use your distribution's security tracker for this CVE to see whether your package is marked affected.
On container hosts and shared build machines, prioritise checking. Cgroups are the base of container resource control, and these machines let many users run code, which matters for a local flaw.
Package managers help with the lookup. For Debian or Ubuntu use apt changelog on the kernel image package and search for the CVE, and for RPM based systems use the changelog query of the rpm tool on the kernel package and search the same way.
What to do now
- Apply the kernel update from your distribution that lists CVE-2026-98163, then reboot.
- Where you cannot reboot quickly, check whether your vendor offers live patching for this CVE.
- Limit who can get a shell on shared hosts, container nodes and CI runners until the update is in.
- For managed Kubernetes or cloud images, confirm the provider has rolled out the fixed node image and upgrade your node pools.
- Record kernel versions per host so you can show which systems have been updated.
Why it matters
The weaknesses are CWE-362, CWE-416: a race condition leading to use after free. Race conditions happen when two code paths touch the same data and the outcome depends on timing. Here the timing involves a reader of the cgroup process list and a thread and group leader exiting at the same time.
A use after free in the kernel is serious because freed memory can be reused for other data. The CVSS score reflects a local attacker with low privileges, with high impact across confidentiality, integrity and availability. The record does not say it has been used in attacks, and KEV is false.
Container hosts bring the local attacker model closer than it first appears, because workloads you do not fully control share a kernel. That is why a local kernel flaw is a normal patch priority on those systems.
Safeguard has a free in-browser dependency scan at gold.safeguard.sh/scan. It covers packages and libraries your projects pull in, so it will not see a standalone application or a kernel, but it is a quick way to find out which third party components you are carrying at all. Reachability analysis then helps you separate vulnerable code that your application actually calls from code that only sits in a dependency tree.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Does a container image scan find this?
No. This is a flaw in the host kernel, which images do not contain. Check the node operating system and kernel version instead.
Which kernels are fixed?
We could not read the kernel commit pages, so we have no version to give. Use your distribution advisory for CVE-2026-98163.
Sources
Gold entry for CVE-2026-98163 Kernel stable commit 057dac23, access error when read Kernel stable commit 82893811, listed in the record, not read
Last reviewed: 18 October 2026.
