CVE-2026-98536: Software Security Vulnerability Vulnerability

UNKNOWN
Advisory Identifier: GHSA-hq8j-r79p-42p5
Share
Published
Advisory Summary

CVE-2026-98536 is a security vulnerability vulnerability (General Security Weakness) affecting Software libraries in the Maven ecosystem. Remediation is available in the latest vendor maintenance releases.

CVE-2026-98536 at a Glance

CVE Identifier CVE-2026-98536
GHSA Identifier GHSA-hq8j-r79p-42p5
Severity N/A
CVSS v3.1 Base Score N/A
CWE Classification General Security Weakness
Affected Product Software
Package Ecosystem Maven
Published Date
Last Updated

How to Fix CVE-2026-98536

To remediate this vulnerability, upgrade all affected Software dependencies to a patched release. Both direct and transitive dependencies should be checked, as frameworks or security libraries may pull in vulnerable versions transitively.

Verify Direct and Transitive Dependencies

Run the following command in your project directory to verify that all resolved dependencies use the patched release: 

mvn dependency:tree

How to Check if You Are Affected

To determine whether your Java application is affected by CVE-2026-98536, inspect your build dependencies using the Maven Dependency Plugin:

mvn dependency:tree

Analyze the terminal output to locate any version of Software in your dependency tree. If any resolved version matches the vulnerable ranges listed in the table below (for example, versions earlier than the patched release), your application is affected.

Note: The mvn dependency:tree command inspects the resolved dependency graph declared in your project's POM files; it does not perform automated security scanning or inspect runtime dynamic classpaths. Always verify runtime container classpaths and shaded JARs.

Technical Details

Vulnerability Mechanism & Technical Analysis

This vulnerability is classified under General Security Weakness. In Software, software state validation or input boundaries are circumvented during processing. Review the official source advisory statement below for specific affected components, classes, and reproduction details.

Source Advisory Statement

In the Linux kernel, the following vulnerability has been resolved: writeback: report a Tasks-RCU quiescent state per cgwb drain pass cleanup_offline_cgwbs_workfn() drains a dying cgwb by calling cleanup_offline_cgwb() until it returns false, with a cond_resched() between passes. On a CONFIG_PREEMPTION kernel that cond_resched() does nothing: _cond_resched() is a plain "return 0", and under PREEMPT_DYNAMIC the full and lazy modes disable it. Since commit 7dadeaa6e851 ("sched: Further restrict the preemption modes") those are the only two models on the architectures with PREEMPT_LAZY support, arm64 and x86 among them, so the drain loop never reports a Tasks-RCU quiescent state. A worker draining a cgwb with millions of attached inodes runs for minutes. On a 6.18 arm64 host in lazy mode the cgwb worker drained one dying cgroup's writeback domain for over 11 minutes. A BPF program unlink (bpf_trampoline_unlink_prog -> bpf_trampoline_update -> unregister_ftrace_direct -> ftrace_shutdown -> synchronize_rcu_tasks()) waited on that grace period while holding the trampoline mutex, 42 tasks queued behind it in D state, and the hung task detector fired at 614 s and panicked the host. Any BPF or ftrace detach during a long drain inherits the drain's length. Fix this by calling cond_resched_tasks_rcu_qs() so we do not stall out anybody who calls sycnrhonize_rcu_tasks(). We put this in a do { } while loop because if we have many small cgroups cleanup_offline_cgwb() will return false and we will never call cond_resched_tasks_rcu_qs(), creating the same problem.

References

NVD — CVE-2026-98536 NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-98536
git.kernel.org/stable/c/260f586a80... WEB
https://git.kernel.org/stable/c/260f586a80e7f624dd7f069898a75a904f34d373
git.kernel.org/stable/c/407a5d2051... WEB
https://git.kernel.org/stable/c/407a5d205179a4ab186571b0e16ec42725dc77bc
git.kernel.org/stable/c/42462b5bb0... WEB
https://git.kernel.org/stable/c/42462b5bb0dec57db7f85d0f77655c737d45754d
git.kernel.org/stable/c/4eb889649e... WEB
https://git.kernel.org/stable/c/4eb889649eaf65f4a5727b04ba1c017b7d05bb16
git.kernel.org/stable/c/863049b401... WEB
https://git.kernel.org/stable/c/863049b4018237d1590cd13b16e9fe9c0faad2c6
git.kernel.org/stable/c/ebf1555ad2... WEB
https://git.kernel.org/stable/c/ebf1555ad2821be06f87a88ffd9a2cab8d2200e1
git.kernel.org/stable/c/fd3bf32279... WEB
https://git.kernel.org/stable/c/fd3bf32279df98751364b3609eb100a3e42f253b

Frequently Asked Questions

What is CVE-2026-98536?
CVE-2026-98536 is a security vulnerability in Software classified as a security vulnerability vulnerability under General Security Weakness.
Which Software versions are affected?
Affected versions include releases prior to current release patches.
What version fixes CVE-2026-98536?
Upgrading to current release patches (or the latest patched release for your respective branch) resolves the vulnerability.
What CWE is associated with CVE-2026-98536?
CVE-2026-98536 is classified under General Security Weakness.
How can I check Maven dependencies for CVE-2026-98536?
Run the dependency tree command: 'mvn dependency:tree'. This command lists direct and transitive dependencies in your build configuration so you can verify if a vulnerable version is resolved.
Machine-readable OSV JSON OSV v1.5 Schema
Normalized schema output
View Raw JSON 
{
  "schema_version" : "1.4.0",
  "id" : "GHSA-hq8j-r79p-42p5",
  "modified" : "2026-10-18T18:31:53Z",
  "published" : "2026-10-18T18:31:53Z",
  "aliases" : [ "CVE-2026-98536" ],
  "details" : "In the Linux kernel, the following vulnerability has been resolved:\n\nwriteback: report a Tasks-RCU quiescent state per cgwb drain pass\n\ncleanup_offline_cgwbs_workfn() drains a dying cgwb by calling\ncleanup_offline_cgwb() until it returns false, with a cond_resched()\nbetween passes.  On a CONFIG_PREEMPTION kernel that cond_resched() does\nnothing: _cond_resched() is a plain \"return 0\", and under PREEMPT_DYNAMIC\nthe full and lazy modes disable it.  Since commit 7dadeaa6e851 (\"sched:\nFurther restrict the preemption modes\") those are the only two models on\nthe architectures with PREEMPT_LAZY support, arm64 and x86 among them, so\nthe drain loop never reports a Tasks-RCU quiescent state.\n\nA worker draining a cgwb with millions of attached inodes runs for\nminutes.  On a 6.18 arm64 host in lazy mode the cgwb worker drained one\ndying cgroup's writeback domain for over 11 minutes.  A BPF program unlink\n(bpf_trampoline_unlink_prog -> bpf_trampoline_update ->\nunregister_ftrace_direct -> ftrace_shutdown -> synchronize_rcu_tasks())\nwaited on that grace period while holding the trampoline mutex, 42 tasks\nqueued behind it in D state, and the hung task detector fired at 614 s and\npanicked the host.  Any BPF or ftrace detach during a long drain inherits\nthe drain's length.\n\nFix this by calling cond_resched_tasks_rcu_qs() so we do not stall out\nanybody who calls sycnrhonize_rcu_tasks().  We put this in a do { } while\nloop because if we have many small cgroups cleanup_offline_cgwb() will\nreturn false and we will never call cond_resched_tasks_rcu_qs(), creating\nthe same problem.",
  "severity" : [ ],
  "affected" : [ ],
  "references" : [ {
    "type" : "ADVISORY",
    "url" : "https://nvd.nist.gov/vuln/detail/CVE-2026-98536"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/260f586a80e7f624dd7f069898a75a904f34d373"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/407a5d205179a4ab186571b0e16ec42725dc77bc"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/42462b5bb0dec57db7f85d0f77655c737d45754d"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/4eb889649eaf65f4a5727b04ba1c017b7d05bb16"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/863049b4018237d1590cd13b16e9fe9c0faad2c6"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/ebf1555ad2821be06f87a88ffd9a2cab8d2200e1"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/fd3bf32279df98751364b3609eb100a3e42f253b"
  } ],
  "database_specific" : {
    "cwe_ids" : [ ],
    "severity" : null,
    "github_reviewed" : false,
    "github_reviewed_at" : null,
    "nvd_published_at" : "2026-10-18T16:17:05Z"
  }
}