sched_ext: Fix CPU hotplug hang when a dying CPU's tasks sit in the BPF scheduler
In the Linux kernel, the following vulnerability has been resolved: sched_ext: Fix CPU hotplug hang when a dying CPU's tasks sit in the BPF scheduler A CPU going down has to empty its own rq. Its hotplug thread waits in sched_cpu_wait_empty() until nothing else is left, and the only thing that wakes it is balance_push(), which runs from __schedule() on the dying CPU and pushes off the migratable tasks the CPU picks. sched_ext breaks this. A task sitting on a user DSQ or held by the BPF scheduler is still counted on its rq, but an inactive CPU no longer calls ops.dispatch() and can't pull the task back. The dying CPU goes idle with the task still counted, and one of two things happens: - Another CPU consumes the task. The rq empties without a __schedule() on the dying CPU, so the hotplug thread is never woken and cpu_down() hangs holding cpu_hotplug_lock. - The task is affine only to the dying CPU. Nothing can move it, and the offline stalls until the watchdog ejects the BPF scheduler. When the rq goes offline, re-enqueue every task on it that isn't already on the local DSQ. An enqueue on an offline rq lands on the local DSQ, so the dying CPU itself picks the tasks and balance_push() pushes them off, the same as for the other sched classes. From then on no sched_ext path on another CPU can pull a task off the rq. ops.dispatch() currently stops as soon as the CPU goes inactive, and CPU hotplug then waits for an RCU grace period before taking the rq offline. A BPF-held task affi
CVE-2026-99085
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: cve:CVE-2026-99085
Linux
Source reference: /containers/cna/affected/0/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Linux
Source reference: /containers/cna/affected/1/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "f0e1a0643a59bf1f922fa209cec86a170b784f3f",
"lessThan": "f79cd7a2df3768323fbfb9b0f96adff08fb7eb4c",
"versionType": "git"
},
{
"status": "affected",
"version": "f0e1a0643a59bf1f922fa209cec86a170b784f3f",
"lessThan": "638ee6bca19750934ea13f9c325f46fd8ae60064",
"versionType": "git"
},
{
"status": "affected",
"version": "f0e1a0643a59bf1f922fa209cec86a170b784f3f",
"lessThan": "173ff9d03ec6373c3158b6e630af33a9b36fd216",
"versionType": "git"
},
{
"status": "affected",
"version": "f0e1a0643a59bf1f922fa209cec86a170b784f3f",
"lessThan": "d35a535d3e3e71f92a051d94e415f43612c4edfc",
"versionType": "git"
}
],
"programFiles": [
"kernel/sched/ext/ext.c",
"kernel/sched/ext/inlines.h",
"kernel/sched/ext/sub.c",
"kernel/sched/sched.h"
],
"defaultStatus": "unaffected"
},
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "6.12"
},
{
"status": "unaffected",
"version": "0",
"lessThan": "6.12",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver",
"lessThanOrEqual": "6.12.*"
},
{
"status": "unaffected",
"version": "6.18.58",
"versionType": "semver",
"lessThanOrEqual": "6.18.*"
},
{
"status": "unaffected",
"version": "7.2.12",
"versionType": "semver",
"lessThanOrEqual": "7.2.*"
},
{
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix",
"lessThanOrEqual": "*"
}
],
"programFiles": [
"kernel/sched/ext/ext.c",
"kernel/sched/ext/inlines.h",
"kernel/sched/ext/sub.c",
"kernel/sched/sched.h"
],
"defaultStatus": "affected"
}
]- Related CVEs
- CVE-2026-99085
Source reference:
/cveMetadata/cveId
Publisher severity
No explicit severity was provided.
- Event
- #52909 · Revision 1
- Added to Heist Feed
- Publisher date