CVE-2026-99085: Linux kernel · sched_ext: Fix CPU hotplug hang when a dying CPU's tasks sit in the BPF scheduler
Source GCVE Database
Not known to be exploited · fixed in f79cd7a2df3768323fbfb9b0f96adff08fb7eb4c : patch Linux kernel soon.
Data as of 26 Oct 2026, 13:47 UTC
Rated by Threat Radar · CVSS not yet scored by NVD
- EPSS
- 0.1% chance of exploitation in 30 days – higher than 5% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
- Patch
- Available – fixed in f79cd7a2df3768323fbfb9b0f96adff08fb7eb4c, d35a535d3e3e71f92a051d94e415f43612c4edfc, 638ee6bca19750934ea13f9c325f46fd8ae60064 +1
Exploitation evidence
Disclosed: evidence found.
CVE published 23 Oct 2026
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors
A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 26 Oct 2026.
What to do
Upgrade Linux kernel to f79cd7a2df3768323fbfb9b0f96adff08fb7eb4c, d35a535d3e3e71f92a051d94e415f43612c4edfc, 638ee6bca19750934ea13f9c325f46fd8ae60064 or 173ff9d03ec6373c3158b6e630af33a9b36fd216.
Affected software
| Product | Affected | Fixed in |
|---|---|---|
| LinuxLinux | Affected
| Fixed in
|
| LinuxLinux | Affected
| Fixed in
|
| LinuxLinux | Affected
| Fixed in
|
| LinuxLinux | Affected
| Fixed in
|
| LinuxLinux | Affected
| Fixed in– |
Description
In the Linux kernel, the following vulnerability has been resolved: sched_ext: Fix CPU hotplug hang when a dying CPU's tasks sit in the BPF scheduler A CPU going down has to empty its own rq. Its hotplug thread waits in sched_cpu_wait_empty() until nothing else is left, and the only thing that wakes it is balance_push(), which runs from __schedule() on the dying CPU and pushes off the migratable tasks the CPU picks. sched_ext breaks this. A task sitting on a user DSQ or held by the BPF scheduler is still counted on its rq, but an inactive CPU no longer calls ops.dispatch() and can't pull the task back. The dying CPU goes idle with the task still counted, and one of two things happens: - Another CPU consumes the task. The rq empties without a __schedule() on the dying CPU, so the hotplug thread is never woken and cpu_down() hangs holding cpu_hotplug_lock. - The task is affine only to the dying CPU. Nothing can move it, and the offline stalls until the watchdog ejects the BPF scheduler. When the rq goes offline, re-enqueue every task on it that isn't already on the local DSQ. An enqueue on an offline rq lands on the local DSQ, so the dying CPU itself picks the tasks and balance_push() pushes them off, the same as for the other sched classes. From then on no sched_ext path on another CPU can pull a task off the rq. ops.dispatch() currently stops as soon as the CPU goes inactive, and CPU hotplug then waits for an RCU grace period before taking the rq offline. A BPF-held task affine only to the dying CPU and preempted inside an RCU read-side critical section would block that grace period, and the rq would never go offline. Test SCX_RQ_ONLINE directly so that ops.dispatch() keeps running until the rq goes offline. Only the dying CPU's own hotplug thread clears the flag during teardown, and task_can_run_on_remote_rq() still keeps other rqs' tasks off the CPU.
References
- nvd.nist.gov/vuln/detail/CVE-2026-99085 (opens in a new tab)
- git.kernel.org/stable/c/173ff9d03ec6373c3158b6e630af33a9b36fd216 (opens in a new tab)
- git.kernel.org/stable/c/638ee6bca19750934ea13f9c325f46fd8ae60064 (opens in a new tab)
- git.kernel.org/stable/c/d35a535d3e3e71f92a051d94e415f43612c4edfc (opens in a new tab)
- git.kernel.org/stable/c/f79cd7a2df3768323fbfb9b0f96adff08fb7eb4c (opens in a new tab)