Live › vulnerability › CVE-2026-99217
A failed fork in the Linux kernel can deadlock while closing a BPF link file descriptor, because the cleanup runs while the fork holds a lock that the sched_ext disable path needs. The sources do not say what an attacker gains beyond blocking new process creation on the system.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-02 16:24 UTC. All times on this page are UTC.
The flaw is in the Linux kernel's process creation path when sched_ext (BPF-based scheduler) is used, so systems running BPF schedulers are the ones to look at. The sources do not say which kernel versions are affected or whether systems without sched_ext are exposed. unknown for the rest.
No product ranges from the sources yet.
uname -r and compare against the kernel versions listed in the upstream fix commit (unknown from these sources)CONFIG_SCHED_CLASS_EXT) enabledUnknown from the sources.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
In the Linux kernel, the following vulnerability has been resolved:
fork: release the files of a failed fork after sched_cancel_fork()
Reorder copy_process() cleanup so sched_fork() taking scx_fork_rwsem scx_pre_fork() is safe and isn't held around exiting files. Right now, a fork that fails while another thread closed the bpf link fd will deadlock against its own read side. It also blocks every fork on the system:
copy_process() holds scx_fork_rwsem for read
exit_files()
close_files()
filp_close_sync()
bpf_scx_unreg()
kthread_flush_work() waits for the disable work
scx_root_disable()
percpu_down_write(&scx_fork_rwsem)
Simply release the child's files after sched_cancel_fork() dropped the lock. The task starts out as a copy of its parent so p->files points to the parent's table until copy_files() replaces it. exit_files() must not run for a fork that failed before that. Clear p->files up front so exit_files() is a no-op for those and make copy_files() set it explicitly for CLONE_FILES.
This page as .md · .json · in your agent: get_signal("CVE-2026-99217")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.