{"id":"CVE-2026-99217","kind":"vulnerability","aliases":["CVE-2026-99217"],"related":[],"title":"Linux kernel: failed fork can deadlock against sched_ext and block all forks","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nfork: release the files of a failed fork after sched_cancel_fork()\n\nReorder copy_process() cleanup so sched_fork() taking scx_fork_rwsem\nscx_pre_fork() is safe and isn't held around exiting files. Right now, a\nfork that fails while another thread closed the bpf link fd will\ndeadlock against its own read side. It also blocks every fork on the\nsystem:\n\n    copy_process()                  holds scx_fork_rwsem for read\n      exit_files()\n        close_files()\n          filp_close_sync()\n            bpf_scx_unreg()\n              kthread_flush_work()  waits for the disable work\n                scx_root_disable()\n                  percpu_down_write(&scx_fork_rwsem)\n\nSimply release the child's files after sched_cancel_fork() dropped the\nlock. The task starts out as a copy of its parent so p->files points to\nthe parent's table until copy_files() replaces it. exit_files() must not\nrun for a fork that failed before that. Clear p->files up front so\nexit_files() is a no-op for those and make copy_files() set it\nexplicitly for CLONE_FILES.","summary":"A failed fork in the Linux kernel can deadlock while closing a BPF link file descriptor, because the cleanup runs while the fork holds a lock that the sched_ext disable path needs. The sources do not say what an attacker gains beyond blocking new process creation on the system.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["bpf","linux-kernel","runtime","sched-ext"],"not_affected_if":["no-sched-ext"],"how_to_check":"- `uname -r` and compare against the kernel versions listed in the upstream fix commit (unknown from these sources)\n- Check whether the kernel is built with sched_ext (`CONFIG_SCHED_CLASS_EXT`) enabled","fix":null,"status":"open","published_at":"2026-11-02T16:17:45+00:00","first_seen_at":"2026-11-02T16:24:05+00:00","triaged_at":"2026-11-02T16:27:03+00:00","updated_at":"2026-11-02T16:27:03+00:00","category":"runtime","confidence":0.4,"triage":{"at":"2026-11-02T16:27:03Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"Linux kernel: failed fork can deadlock against sched_ext and block all forks","impact":"low","summary":"A failed fork in the Linux kernel can deadlock while closing a BPF link file descriptor, because the cleanup runs while the fork holds a lock that the sched_ext disable path needs. The sources do not say what an attacker gains beyond blocking new process creation on the system.","audience":"businesses","category":"runtime","nicknames":[],"who_cares":["linux-kernel","sched-ext","bpf"],"confidence":0.4,"fix_status":"unknown","needs_auth":"unknown","worst_case":"Denial of service: new process creation blocks across the whole system","analyst_note":"Confirm affected kernel version ranges and the upstream fix commit from the NVD entry and kernel.org stable tree; confirm whether the scenario requires local access.","how_to_check":"- `uname -r` and compare against the kernel versions listed in the upstream fix commit (unknown from these sources)\n- Check whether the kernel is built with sched_ext (`CONFIG_SCHED_CLASS_EXT`) enabled\n- unknown for further steps; the sources do not say","plain_action":"","needs_analyst":true,"not_affected_if":["no-sched-ext"],"who_is_affected":"The flaw is in the Linux kernel's process creation path when sched_ext (BPF-based scheduler) is used, so systems running BPF schedulers are the ones to look at. The sources do not say which kernel versions are affected or whether systems without sched_ext are exposed. unknown for the rest.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000739,"input_tokens":4408,"output_tokens":597,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':15A,18A '-99217':16A,19A 'also':145C 'anoth':130C 'around':120C 'attack':68B 'beyond':70B 'block':11A,71B,146C 'bpf':20B,40B,134C,167C 'cancel':98C,195C 'child':190C 'cleanup':46B,103C 'clear':236C 'clone':259C 'close':38B,132C,162C,165C 'copi':101C,152C,206C,220C,253C 'creation':74B 'cve':14A,17A 'deadlock':6A,36B,138C 'descriptor':43B 'disabl':58B,176C,180C 'drop':197C 'everi':147C 'exit':121C,160C,224C,242C 'explicit':257C 'ext':9A,27B,57B 'fail':3A,29B,94C,128C,233C 'fd':136C 'file':42B,91C,122C,161C,163C,192C,212C,221C,225C,238C,243C,254C,260C 'filp':164C 'flush':171C 'follow':83C 'fork':4A,13A,30B,50B,88C,95C,99C,106C,109C,113C,126C,148C,156C,185C,196C,231C 'front':240C 'gain':69B 'held':119C 'hold':51B,154C 'isn':117C 'kernel':2A,23B,34B,81C 'kthread':170C 'link':41B,135C 'linux':1A,22B,33B,80C 'linux-kernel':21B 'lock':53B,199C 'make':252C 'must':226C 'need':60B 'new':72B 'no-op':246C 'op':248C 'p':211C,237C 'parent':209C,216C 'path':59B 'percpu':181C 'point':213C 'pre':112C 'process':73B,102C,153C 'read':142C,159C 'releas':89C,188C 'reorder':100C 'replac':222C 'resolv':87C 'right':123C 'root':179C 'run':47B,228C 'runtim':24B 'rwsem':110C,157C,186C 'safe':115C 'say':65B 'sched':8A,26B,56B,97C,105C,194C 'sched-ext':25B 'scx':108C,111C,155C,168C,178C,184C 'set':255C 'side':143C 'simpli':187C 'sourc':62B 'start':202C 'sync':166C 'system':77B,151C 'tabl':218C 'take':107C 'task':201C 'thread':131C 'unreg':169C 'vulner':84C 'wait':173C 'work':172C,177C 'write':183C","nicknames":[],"mitigations":[],"who_affected":"The flaw is in the Linux kernel's process creation path when sched_ext (BPF-based scheduler) is used, so systems running BPF schedulers are the ones to look at. The sources do not say which kernel versions are affected or whether systems without sched_ext are exposed. unknown for the rest.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["bpf","linuxkernel","runtime","schedext","unknown"],"first_public_at":"2026-11-02T16:17:45+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-99217","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-99217","severity":null,"published_at":"2026-11-02T16:17:45+00:00","modified_at":"2026-11-02T16:17:45+00:00","first_seen_at":"2026-11-02T16:24:05+00:00","fetched_at":"2026-11-02T16:24:05+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}