CVE-2025-39953

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> cgroup: split cgroup_destroy_wq into 3 workqueues<br /> <br /> A hung task can occur during [1] LTP cgroup testing when repeatedly<br /> mounting/unmounting perf_event and net_prio controllers with<br /> systemd.unified_cgroup_hierarchy=1. The hang manifests in<br /> cgroup_lock_and_drain_offline() during root destruction.<br /> <br /> Related case:<br /> cgroup_fj_function_perf_event cgroup_fj_function.sh perf_event<br /> cgroup_fj_function_net_prio cgroup_fj_function.sh net_prio<br /> <br /> Call Trace:<br /> cgroup_lock_and_drain_offline+0x14c/0x1e8<br /> cgroup_destroy_root+0x3c/0x2c0<br /> css_free_rwork_fn+0x248/0x338<br /> process_one_work+0x16c/0x3b8<br /> worker_thread+0x22c/0x3b0<br /> kthread+0xec/0x100<br /> ret_from_fork+0x10/0x20<br /> <br /> Root Cause:<br /> <br /> CPU0 CPU1<br /> mount perf_event umount net_prio<br /> cgroup1_get_tree cgroup_kill_sb<br /> rebind_subsystems // root destruction enqueues<br /> // cgroup_destroy_wq<br /> // kill all perf_event css<br /> // one perf_event css A is dying<br /> // css A offline enqueues cgroup_destroy_wq<br /> // root destruction will be executed first<br /> css_free_rwork_fn<br /> cgroup_destroy_root<br /> cgroup_lock_and_drain_offline<br /> // some perf descendants are dying<br /> // cgroup_destroy_wq max_active = 1<br /> // waiting for css A to die<br /> <br /> Problem scenario:<br /> 1. CPU0 mounts perf_event (rebind_subsystems)<br /> 2. CPU1 unmounts net_prio (cgroup_kill_sb), queuing root destruction work<br /> 3. A dying perf_event CSS gets queued for offline after root destruction<br /> 4. Root destruction waits for offline completion, but offline work is<br /> blocked behind root destruction in cgroup_destroy_wq (max_active=1)<br /> <br /> Solution:<br /> Split cgroup_destroy_wq into three dedicated workqueues:<br /> cgroup_offline_wq – Handles CSS offline operations<br /> cgroup_release_wq – Manages resource release<br /> cgroup_free_wq – Performs final memory deallocation<br /> <br /> This separation eliminates blocking in the CSS free path while waiting for<br /> offline operations to complete.<br /> <br /> [1] https://github.com/linux-test-project/ltp/blob/master/runtest/controllers