VulnerabilityPublished 25 Sep 2026Updated 19 Oct 2026

CVE-2026-98087: Linux kernel · sched/rt,dl: Skip migrate-disabled tasks when picking a push candidate

Affects Linux kernelSource CVE Database V5

Not known to be exploited · fixed in dae5c0292080dd7b9c7d784268dcf443f1f3d15e : update Linux kernel when convenient.

Data as of 26 Oct 2026, 17:16 UTC

Severity

Medium

Rated Medium by Threat Radar's AI analysis · CVSS not yet scored by NVD

EPSS: 0.1% chance of exploitation in 30 days – higher than 5% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
Patch: Available – fixed in dae5c0292080dd7b9c7d784268dcf443f1f3d15e, b0c6f947057751ab4d30ccf8095cd19804fb97fa, 755476d7ba92a1f3fe2a376c515d710bc6baebc3

Exploitation evidence

Disclosed: evidence found.
CVE published 25 Sep 2026
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors

A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 26 Oct 2026.

Disclosed: The CVE record is public on cve.org. Its publication is t = 0.
Detectable: A public nuclei template can find exposed instances, for defenders and attackers alike.
Weaponised: Public exploit code exists in Metasploit or Exploit-DB, or CISA SSVC or the CVSS exploit maturity reports a public proof of concept.
Exploited in the wild: CISA KEV lists it, CISA SSVC rates exploitation active, or a source reports attacks.
Observed by OffSeq Mirage: OffSeq Mirage honeypot sensors recorded attack traffic for this CVE, or found exposed hosts without attack traffic.

Moments are spaced evenly, not to scale; a dashed line marks a gap of six months or more. Deltas count from t = 0. Sources that give only a date (CISA KEV, Exploit-DB, or a time of exactly 00:00Z) read “same day” rather than hours. Metasploit modules carry the flaw’s disclosure date, not their release date, and nuclei templates carry no date, so both appear above but not on the timeline.

What to do

Upgrade Linux kernel to dae5c0292080dd7b9c7d784268dcf443f1f3d15e, b0c6f947057751ab4d30ccf8095cd19804fb97fa or 755476d7ba92a1f3fe2a376c515d710bc6baebc3.

Affected software

Product	Affected	Fixed in
LinuxLinux	Affected ≥ a7c81556ec4d341dfdbf2cc478ead89d73e474a7, < dae5c0292080dd7b9c7d784268dcf443f1f3d15e	Fixed in dae5c0292080dd7b9c7d784268dcf443f1f3d15e
LinuxLinux	Affected ≥ a7c81556ec4d341dfdbf2cc478ead89d73e474a7, < b0c6f947057751ab4d30ccf8095cd19804fb97fa	Fixed in b0c6f947057751ab4d30ccf8095cd19804fb97fa
LinuxLinux	Affected ≥ a7c81556ec4d341dfdbf2cc478ead89d73e474a7, < 755476d7ba92a1f3fe2a376c515d710bc6baebc3	Fixed in 755476d7ba92a1f3fe2a376c515d710bc6baebc3
LinuxLinux	Affected =5.11	Fixed in–

AI-suggested

A fix is available in the Linux kernel commits dae5c0292080dd7b9c7d784268dcf443f1f3d15e, b0c6f947057751ab4d30ccf8095cd19804fb97fa, and 755476d7ba92a1f3fe2a376c515d710bc6baebc3. Users should upgrade to a patched kernel version incorporating these commits to resolve the issue. No other mitigation is indicated by the vendor advisory.

Description

CVE-2026-98087 is a Linux kernel scheduler vulnerability affecting version 5.11 where migrate-disabled real-time (RT) tasks remain incorrectly marked as pushable, causing the scheduler to repeatedly attempt to move these tasks unsuccessfully. This results in excessive CPU time spent in a retry loop, degrading real-time performance by consuming CPU cycles without progress. The issue has been fixed in later commits.

Impact

Affected systems running Linux kernel version 5.11 experience degraded real-time scheduling performance due to the scheduler wasting CPU time in a retry loop attempting to migrate pinned migrate-disabled RT tasks. This results in significant CPU time consumed by migration attempts that never succeed, reducing the CPU availability for actual real-time tasks and potentially impacting time-sensitive workloads.

Summary

The vulnerability involves the Linux kernel scheduler's handling of migrate-disabled RT tasks. Such tasks cannot be moved to another CPU, but the scheduler erroneously keeps them on the CPU's pushable task list and marks the runqueue as RT-overloaded. Consequently, the RT balancer repeatedly tries to push these pinned tasks, which always fails, causing the CPU to spend tens of milliseconds in a retry loop. The fallback mechanism attempts to push the currently running task, which is never on the pushable list, causing a re-check failure and no task migration. This loop continues until the running task sleeps, wasting CPU time and preventing the pinned task from running. The issue was resolved by skipping migrate-disabled tasks when selecting push candidates, with fixes applied in commits dae5c0292080dd7b9c7d784268dcf443f1f3d15e, b0c6f947057751ab4d30ccf8095cd19804fb97fa, and 755476d7ba92a1f3fe2a376c515d710bc6baebc3.

References

Community reviews

Loading reviews…

Exploitation evidence

What to do

Affected software

Description

AI analysisMachine-generated, updated 26 Oct 2026, 12:43 UTC

Technical details

References

Community reviews

Related threats