CVE-2026-98542

In the Linux kernel, the following vulnerability has been resolved:

cgroup/cpuset: Return PERR NOCPUS in remote partition enable() on subpartitions cpus conflict

When a remote partition is created underneath an existing local partition via a non-partition (PRS MEMBER) intermediate cgroup, update prstate() sees parent->partition root state == PRS MEMBER and calls remote partition enable().

Commit 86888c7bd117 ("cgroup/cpuset: Add warnings to catch inconsistency in exclusive CPUs") replaced the cpumask intersects(tmp->new cpus, subpartitions cpus) error check in remote partition enable() with WARN ON ONCE(). As a result, remote partition enable() emits a warning and proceeds to enable the remote partition on CPUs that are already owned by the ancestor local partition in subpartitions cpus.

This can be reproduced on Linux 7.3.0-rc3 with:

mkdir -p /tmp/cg1 mount -t cgroup2 none /tmp/cg1 echo "+cpuset" > /tmp/cg1/cgroup.subtree control

mkdir /tmp/cg1/A echo 1 > /tmp/cg1/A/cpuset.cpus echo 1 > /tmp/cg1/A/cpuset.cpus.exclusive echo root > /tmp/cg1/A/cpuset.cpus.partition echo "+cpuset" > /tmp/cg1/A/cgroup.subtree control

mkdir /tmp/cg1/A/B echo 1 > /tmp/cg1/A/B/cpuset.cpus echo 1 > /tmp/cg1/A/B/cpuset.cpus.exclusive echo "+cpuset" > /tmp/cg1/A/B/cgroup.subtree control

mkdir /tmp/cg1/A/B/D echo 1 > /tmp/cg1/A/B/D/cpuset.cpus echo 1 > /tmp/cg1/A/B/D/cpuset.cpus.exclusive echo root > /tmp/cg1/A/B/D/cpuset.cpus.partition

which triggers:

WARNING: kernel/cgroup/cpuset.c:1594 at remote partition enable+0x1c1/0x300

and leaves both /tmp/cg1/A and /tmp/cg1/A/B/D as active root partitions claiming exclusive CPU 1.

Fix this by returning PERR NOCPUS when tmp->new cpus intersects subpartitions cpus in remote partition enable(), matching the error code used by remote cpus update() for the same subpartitions cpus conflict, and add a regression test case to tools/testing/selftests/cgroup/test cpuset prs.sh.

Tested in QEMU on Linux 7.3.0-rc3 using the reproducer above and tools/testing/selftests/cgroup/test cpuset prs.sh.