CVE-2026-74594

A flaw was found in the Linux kernel's Pressure Stall Information (PSI) subsystem. A race condition exists where a timer (rtpoll_timer) can be re-armed after it has been deleted during the destruction of a control group (cgroup). This can lead to the timer function executing on freed memory, potentially causing system instability or a crash. This vulnerability arises from an improper shutdown of the rtpoll_timer in psi_cgroup_free().

A race in sched/psi can leave rtpoll_timer() armed after the last PSI trigger is destroyed and the owning cgroup PSI state is freed. psi_schedule_rtpoll_work() can run locklessly from the scheduler hotpath and call mod_timer() after psi_trigger_destroy() has called timer_delete(), so poll_timer_fn() may later run on freed memory. For the CVSS the PR:L is chosen because a local user or delegated service with access to PSI triggers and cgroup lifecycle operations may be able to exercise the vulnerable path without full host root. The issue is not network reachable and requires local control plane activity around PSI trigger teardown and cgroup removal.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.