# CVE-2026-99065: cgroup/cpuset: Handle cpu hotplug race in guarantee_active_cpus()


- **Severity:** Not scored
- **Exploited in the wild:** Not known
- **Fix available:** Yes
- **Published:** 23 Oct 2026
- **Updated:** 23 Oct 2026
- **Also known as:** BELL-CVE-2026-99065, DEBIAN-CVE-2026-99065, GHSA-px5v-f8qg-w5f8, UBUNTU-CVE-2026-99065

## What is CVE-2026-99065?

CVE-2026-99065 is a vulnerability in Linux, published on 23 Oct 2026. 

### Official description

In the Linux kernel, the following vulnerability has been resolved:

cgroup/cpuset: Handle cpu hotplug race in guarantee_active_cpus()

With commit 2125c0034c5d ("cgroup/cpuset: Make cpuset hotplug processing
synchronous"), the cpuset hotplug operation becomes synchronous. That
commit also removes the code that handles race between cpuset_hotplug_work
and cpu hotplug notifier with the assumption that race is now gone.
Later commit 7a0aabd9ce69 ("cgroup/cpuset: Always use cpu_active_mask")
updates the cpuset code to always use cpu_active_mask instead of
cpu_online_mask in some places including guarantee_online_cpus() which
is renamed to guarantee_active_cpus() in that commit.

In the case of CPU offline operation, cpu_active_mask is updated
first in sched_cpu_deactivate() to remove the offline CPU before
cpuset_handle_hotplug() is called to update the effective_cpus of the
affected cpusets. The cpu_online_mask is updated after that near the end
of the offline operation to remove the offline CPU. As a result, the race
comes back and the top cpuset may not have any active CPU leading to NULL
pointer dereference during the race window when guarantee_active_cpus()
is called after cpu_active_mask is updated to remove the CPU to be torn
down but before cpuset_handle_hotplug() is able to properly update the
effective_cpus of the top cpuset.

Fix this by adding back the NULL cs check to avoid this problem.

## Which versions are affected by CVE-2026-99065?


## How do I fix CVE-2026-99065?

Upgrade to a fixed version.

## Is CVE-2026-99065 being exploited?

There is no known exploitation of CVE-2026-99065 in the wild and no public exploit code.

## Fix prompt for AI coding agents

```text
Check this codebase for CVE-2026-99065 and fix it if it is affected.

What it is: CVE-2026-99065 is a vulnerability in Linux, published on 23 Oct 2026. 
Exploitation: There is no known exploitation of CVE-2026-99065 in the wild and no public exploit code.

Affected product: Linux. No package-level version data is available, so check the vendor advisory linked from the reference page.

Task:
1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.
2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.
3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.
4. Run the tests and summarise what changed and why.
5. If nothing in the project is affected, say so and change nothing.

Reference: https://insights.sbomify.com/CVE-2026-99065/ (Markdown: https://insights.sbomify.com/CVE-2026-99065/index.md)
```

## Sources

- CVE record: https://www.cve.org/CVERecord?id=CVE-2026-99065
- NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-99065
- OSV: https://osv.dev/vulnerability/CVE-2026-99065

---
From sbomify Insights: https://insights.sbomify.com/CVE-2026-99065/
Summaries are generated and may contain mistakes; the official description above is the record.