CVE-2026-99065

In the Linux kernel, the following vulnerability has been resolved:

cgroup/cpuset: Handle cpu hotplug race in guarantee active cpus()

With commit 2125c0034c5d ("cgroup/cpuset: Make cpuset hotplug processing synchronous"), the cpuset hotplug operation becomes synchronous. That commit also removes the code that handles race between cpuset hotplug work and cpu hotplug notifier with the assumption that race is now gone. Later commit 7a0aabd9ce69 ("cgroup/cpuset: Always use cpu active mask") updates the cpuset code to always use cpu active mask instead of cpu online mask in some places including guarantee online cpus() which is renamed to guarantee active cpus() in that commit.

In the case of CPU offline operation, cpu active mask is updated first in sched cpu deactivate() to remove the offline CPU before cpuset handle hotplug() is called to update the effective cpus of the affected cpusets. The cpu online mask is updated after that near the end of the offline operation to remove the offline CPU. As a result, the race comes back and the top cpuset may not have any active CPU leading to NULL pointer dereference during the race window when guarantee active cpus() is called after cpu active mask is updated to remove the CPU to be torn down but before cpuset handle hotplug() is able to properly update the effective cpus of the top cpuset.

Fix this by adding back the NULL cs check to avoid this problem.