{"id":"CVE-2026-99205","kind":"vulnerability","aliases":["CVE-2026-99205"],"related":[],"title":"Linux kernel: scheduler race can leave a CPU idle with runnable tasks","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nsched/core: Call wakeup_preempt() for queued tasks during class change\n\nPaul reported recent RCU changes exposed a lost resched where CPU idles\nwith a rcutorture thread waiting while being completely runnable.\n\nDumping the rq state at the time of idling with runnable tasks showed\nthe following:\n\n  rq->next_class = &fair_sched_class\n  rq->nr_running = 1\n  rq->cfs.h_nr_queued = 0\n  rq->rt.rt_nr_running = 1\n\nAlthough the waiting task was an RT task, \"rq->next_class\" did not point\nto rt_sched_class and was stuck at the lower priority fair_sched_class.\n\nInspecting sched_change_end() revealed the following race with\n__sched_setscheduler() for queued, but non-running tasks:\n\n    CPU0                                   CPU1\n    ====                                   ====\n\n  __schedule()\n\n    /*\n     * rq->donor is a fair task that blocks.\n     * rq->next_class = &fair_sched_class\n     */\n\n    rq_lock(rq0)\n\n    pick_next_task()\n      /* nr_running = 0 */\n      pick_task_fair()\n        sched_balance_newidle()\n          raw_spin_rq_unlock(rq0)\n                                    rq_lock(rq0)\n\n                                    activate_task(rq0, p)\n                                      /* p is a fair task */\n                                      rq0->nr_running++;\n                                      rq0->cfs.h_nr_queued++;\n                                      wakeup_preempt(rq, p)\n                                        rq->next_class = &fair_sched_class\n                                        resched_curr()\n\n                                    rq_unlock(rq0)\n\n                                    __sched_setscheduler(p)\n                                      /* p is moved to SCHED_RR */\n                                      task_rq_lock(p)\n                                      sched_change_begin()\n\n\t\t\t\t      rq0->cfs.h_nr_queued--;\n\t\t\t\t      rq0->rt.rt_nr_running++;\n\n                                      sched_change_end()\n                                        /*\n                                         * p->on_rq = 1 (ctx->queued)\n                                         * but p is not rq->donor\n                                         * (!ctx->running) hence\n                                         * resched_curr() is and\n                                         * rq->next_class upgrade is\n                                         * skipped.\n                                         */\n\n                                       task_rq_unlock()\n\n          raw_spin_rq_lock(rq0)\n\n          /*\n           * rq->nr_running = 1\n           * rq->cfs.h_nr_queued = 0\n           * rq->rt.rt_nr_running = 1\n           * rq->next_class = &fair_sched_class\n           */\n\n           if (rq->cfs.h_nr_queued && ...)\n             /* Above is false */\n\n           if (rq_modified_above(this_rq, &fair_sched_class))\n             /* Also false since rq->next_class is still fair */\n\n      /*\n       * sched_balance_newidle() is considered to\n       * have failed to pull any fair tasks and no\n       * other wakeups were detected.\n       */\n       return NULL; /* pick_task_fair() */\n\n    pick_task_idle()\n      return rq->idle;\n\n    next = rq->idle;\n\n    /* Preemption indicators are lost */\n    clear_tsk_need_resched(prev);\n    clear_preempt_need_resched();\n\n    rq->curr = rq->idle;\n\n  !!! rq->idle switches in with rq->running == 1 but !need_resched() !!!\n\nIn simple words, enqueue, followed by a class change of the newly queued\ntask goes unnoticed in rq->next_class indicator and\nsched_balance_newidle() sees no fair task, nor any higher priority task\nenqueued.\n\nThe above sequence will lead to CPU idling with a runnable task on the\nCPU.\n\nCall wakeup_preempt() for ctx->queued cases in sched_change_end() to\nre-evaluate rq->next_class after class change (ENQUEUE_CLASS) and set\nthe NEED_RESCHED indicator accordingly.\n\nNewidle balance will correctly see an enqueue of a higher priority\nt\n---truncated---","summary":"A race in the Linux kernel scheduler during a task class change can leave a CPU idling while a runnable real-time task waits on its run queue. The sources describe the scheduling stall but do not say that an attacker can use it to run code or read data.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["kernel","linux","real-time-workloads","runtime","self-hosted"],"not_affected_if":["patched-kernel"],"how_to_check":"- `uname -r` and compare against the fixed kernel builds in the upstream stable advisory for CVE-2026-99205\n- unknown for other checks, the sources do not say","fix":"- Install the kernel release that carries the upstream commit 'sched/core: Call wakeup_preempt() for queued tasks during class change' from your distribution or the kernel.org stable branch, then reboot\n- unknown for a specific version, the sources do not say","status":"open","published_at":"2026-10-28T11:17:41+00:00","first_seen_at":"2026-10-28T11:32:37+00:00","triaged_at":"2026-10-28T11:33:57+00:00","updated_at":"2026-10-28T11:33:57+00:00","category":"runtime","confidence":0.5,"triage":{"at":"2026-10-28T11:33:57Z","model":"claude-haiku-5-5","output":{"fix":"- Install the kernel release that carries the upstream commit 'sched/core: Call wakeup_preempt() for queued tasks during class change' from your distribution or the kernel.org stable branch, then reboot\n- unknown for a specific version, the sources do not say","reach":"local","title":"Linux kernel: scheduler race can leave a CPU idle with runnable tasks","impact":"low","summary":"A race in the Linux kernel scheduler during a task class change can leave a CPU idling while a runnable real-time task waits on its run queue. The sources describe the scheduling stall but do not say that an attacker can use it to run code or read data.","category":"runtime","nicknames":[],"who_cares":["linux","kernel","self-hosted","real-time-workloads"],"confidence":0.5,"needs_auth":"unknown","worst_case":"unknown; the sources describe a CPU idling with runnable tasks","analyst_note":"Check the NVD entry and the kernel.org stable commit for affected version ranges and whether the stall can be triggered by an unprivileged user; the text was truncated.","how_to_check":"- `uname -r` and compare against the fixed kernel builds in the upstream stable advisory for CVE-2026-99205\n- unknown for other checks, the sources do not say","needs_analyst":true,"not_affected_if":["patched-kernel"],"who_is_affected":"Any system running a Linux kernel build that predates the fix, including servers and workstations that use real-time scheduling policies such as SCHED_RR or SCHED_FIFO under load. The sources do not describe a remote trigger, so systems without real-time tasks or with patched kernels can skip it. Exposure beyond a performance stall is unknown.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000769,"input_tokens":4589,"output_tokens":621,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':14A,17A '-99205':15A,18A '0':148C,225C,333C '1':145C,153C,297C,330C,338C,426C 'accord':509C 'activ':240C 'also':360C 'although':154C 'attack':70B 'balanc':230C,370C,453C,511C 'begin':284C 'block':210C 'call':91C,480C 'case':486C 'cfs.h_nr_queued':147C,253C,332C,347C 'cfs.h_nr_queued--':286C 'chang':40B,99C,104C,184C,283C,292C,438C,489C,500C 'class':39B,98C,138C,141C,164C,171C,181C,213C,216C,260C,263C,315C,341C,344C,359C,365C,437C,449C,497C,499C,502C 'clear':406C,411C 'code':76B 'complet':119C 'consid':373C 'correct':513C 'cpu':8A,44B,110C,471C,479C 'cpu0':200C 'cpu1':201C 'ctx':298C,306C,484C 'curr':265C,310C,416C 'cve':13A,16A 'data':79B 'describ':60B 'detect':387C 'donor':204C,305C 'dump':121C 'end':185C,293C,490C 'enqueu':433C,464C,501C,516C 'evalu':494C 'expos':105C 'fail':376C 'fair':139C,179C,207C,214C,228C,247C,261C,342C,357C,368C,380C,392C,457C 'fals':350C,361C 'follow':85C,135C,188C,434C 'goe':444C 'henc':308C 'higher':461C,519C 'host':28B 'idl':9A,45B,111C,129C,395C,398C,401C,418C,420C,472C 'indic':403C,450C,508C 'inspect':182C 'kernel':2A,19B,34B,83C 'lead':469C 'leav':6A,42B 'linux':1A,20B,33B,82C 'lock':218C,238C,280C,325C 'lost':107C,405C 'lower':177C 'modifi':353C 'move':274C 'need':408C,413C,428C,506C 'newidl':231C,371C,454C,510C 'newli':441C 'next':137C,163C,212C,221C,259C,314C,340C,364C,399C,448C,496C 'non':197C 'non-run':196C 'nr':143C,151C,223C,250C,289C,328C,336C 'null':389C 'p':243C,244C,257C,271C,272C,281C,294C,301C 'paul':100C 'pick':220C,226C,390C,393C 'point':167C 'preempt':93C,255C,412C,482C 'preemption':402C 'prev':410C 'prioriti':178C,462C,520C 'pull':378C 'queu':95C,194C,299C,442C,485C 'queue':57B 'race':4A,30B,189C 'raw':232C,322C 'rcu':103C 'rcutortur':114C 're':493C 're-evalu':492C 'read':78B 'real':22B,50B 'real-tim':49B 'real-time-workload':21B 'recent':102C 'report':101C 'resch':108C,264C,309C,409C,414C,429C,507C 'resolv':89C 'return':388C,396C 'reveal':186C 'rq':123C,136C,142C,146C,149C,162C,203C,211C,217C,234C,237C,256C,258C,266C,279C,296C,304C,313C,320C,324C,327C,331C,334C,339C,346C,352C,356C,363C,397C,400C,415C,417C,419C,424C,447C,495C 'rq0':219C,236C,239C,242C,249C,252C,268C,285C,287C,326C 'rr':277C 'rt':160C,169C 'rt.rt':150C,288C,335C 'run':56B,75B,144C,152C,198C,224C,251C,290C,307C,329C,337C,425C 'runnabl':11A,48B,120C,131C,475C 'runtim':25B 'say':67B 'sched':140C,170C,180C,183C,191C,215C,229C,262C,269C,276C,282C,291C,343C,358C,369C,452C,488C 'sched/core':90C 'schedul':3A,35B,62B,202C 'see':455C,514C 'self':27B 'self-host':26B 'sequenc':467C 'set':504C 'setschedul':192C,270C 'show':133C 'simpl':431C 'sinc':362C 'skip':318C 'sourc':59B 'spin':233C,323C 'stall':63B 'state':124C 'still':367C 'stuck':174C 'switch':421C 'task':12A,38B,52B,96C,132C,157C,161C,199C,208C,222C,227C,241C,248C,278C,319C,381C,391C,394C,443C,458C,463C,476C 'thread':115C 'time':23B,51B,127C 'truncat':522C 'tsk':407C 'unlock':235C,267C,321C 'unnot':445C 'upgrad':316C 'use':72B 'vulner':86C 'wait':53B,116C,156C 'wakeup':92C,254C,385C,481C 'word':432C 'workload':24B","nicknames":[],"mitigations":[],"who_affected":"Any system running a Linux kernel build that predates the fix, including servers and workstations that use real-time scheduling policies such as SCHED_RR or SCHED_FIFO under load. The sources do not describe a remote trigger, so systems without real-time tasks or with patched kernels can skip it. Exposure beyond a performance stall is unknown.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-28T11:17:41+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-99205","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-99205","severity":null,"published_at":"2026-10-28T11:17:41+00:00","modified_at":"2026-10-28T11:17:41+00:00","first_seen_at":"2026-10-28T11:32:37+00:00","fetched_at":"2026-10-28T11:32:37+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}