---
id: "CVE-2026-99217"
kind: "vulnerability"
aliases: ["CVE-2026-99217"]
title: "Linux kernel: failed fork can deadlock against sched_ext and block all forks"
severity: "unknown"
cvss: null
epss: null
exploited: false
status: "open"
category: "runtime"
products: []
ecosystems: []
tags: ["bpf", "linux-kernel", "runtime", "sched-ext"]
not_affected_if: ["no-sched-ext"]
published_at: "2026-11-02T16:17:45+00:00"
first_seen_at: "2026-11-02T16:24:05+00:00"
updated_at: "2026-11-02T16:27:03+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-99217", "first_seen_at": "2026-11-02T16:24:05+00:00"}]
---

# Linux kernel: failed fork can deadlock against sched_ext and block all forks

A failed fork in the Linux kernel can deadlock while closing a BPF link file descriptor, because the cleanup runs while the fork holds a lock that the sched_ext disable path needs. The sources do not say what an attacker gains beyond blocking new process creation on the system.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- `uname -r` and compare against the kernel versions listed in the upstream fix commit (unknown from these sources)
- Check whether the kernel is built with sched_ext (`CONFIG_SCHED_CLASS_EXT`) enabled

## Timeline

- 2026-11-02T16:24:05+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-99217

## From the sources

In the Linux kernel, the following vulnerability has been resolved:

fork: release the files of a failed fork after sched_cancel_fork()

Reorder copy_process() cleanup so sched_fork() taking scx_fork_rwsem
scx_pre_fork() is safe and isn't held around exiting files. Right now, a
fork that fails while another thread closed the bpf link fd will
deadlock against its own read side. It also blocks every fork on the
system:

    copy_process()                  holds scx_fork_rwsem for read
      exit_files()
        close_files()
          filp_close_sync()
            bpf_scx_unreg()
              kthread_flush_work()  waits for the disable work
                scx_root_disable()
                  percpu_down_write(&scx_fork_rwsem)

Simply release the child's files after sched_cancel_fork() dropped the
lock. The task starts out as a copy of its parent so p->files points to
the parent's table until copy_files() replaces it. exit_files() must not
run for a fork that failed before that. Clear p->files up front so
exit_files() is a no-op for those and make copy_files() set it
explicitly for CLONE_FILES.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_