VulnerabilityPublished 28 Oct 2026

CVE-2026-99205: Linux kernel · sched/core: Call wakeup_preempt() for queued tasks during class change

Source GCVE Database

Authoritative record:CVE-2026-99205

Not known to be exploited : upgrade to ae89744c5ebf299bf55ac7581768fbd9f119a903 or 118a2cf4ced60777a2408001e2b4838fed1cea55 when convenient.

Data as of 28 Oct 2026, 13:42 UTC

Severity

Medium

Rated Medium by Threat Radar's AI analysis · CVSS not yet scored by NVD

Patch: Available – fixed in ae89744c5ebf299bf55ac7581768fbd9f119a903, 118a2cf4ced60777a2408001e2b4838fed1cea55

Exploitation evidence

Disclosed: evidence found.
CVE published 28 Oct 2026
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors

A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 26 Oct 2026.

Disclosed: The CVE record is public on cve.org. Its publication is t = 0.
Detectable: A public nuclei template can find exposed instances, for defenders and attackers alike.
Weaponised: Public exploit code exists in Metasploit or Exploit-DB, or CISA SSVC or the CVSS exploit maturity reports a public proof of concept.
Exploited in the wild: CISA KEV lists it, CISA SSVC rates exploitation active, or a source reports attacks.
Observed by OffSeq Mirage: OffSeq Mirage honeypot sensors recorded attack traffic for this CVE, or found exposed hosts without attack traffic.

Moments are spaced evenly, not to scale; a dashed line marks a gap of six months or more. Deltas count from t = 0. Sources that give only a date (CISA KEV, Exploit-DB, or a time of exactly 00:00Z) read “same day” rather than hours. Metasploit modules carry the flaw’s disclosure date, not their release date, and nuclei templates carry no date, so both appear above but not on the timeline.

ghsa-2frc-h2g3-59hw

What to do

Upgrade Linux kernel to ae89744c5ebf299bf55ac7581768fbd9f119a903 or 118a2cf4ced60777a2408001e2b4838fed1cea55.

Affected software

Product	Affected	Fixed in
LinuxLinux	Affected ≥ 704069649b5bfb7bf1fe32c0281fe9036806a59a, < ae89744c5ebf299bf55ac7581768fbd9f119a903	Fixed in ae89744c5ebf299bf55ac7581768fbd9f119a903
LinuxLinux	Affected ≥ 704069649b5bfb7bf1fe32c0281fe9036806a59a, < 118a2cf4ced60777a2408001e2b4838fed1cea55	Fixed in 118a2cf4ced60777a2408001e2b4838fed1cea55
LinuxLinux	Affected =7.0	Fixed in–

AI-suggested

A fix for this issue has been implemented in the Linux kernel by adding a call to wakeup_preempt() during task class changes for queued tasks. Users should apply the official kernel updates that include this fix. Since no vendor advisory or patch links are provided, confirm patch availability from the Linux kernel stable release notes or trusted sources before deployment.

Description

CVE-2026-99205 is a Linux kernel scheduler vulnerability involving a race condition during task class changes. The flaw causes the CPU to idle despite having runnable tasks due to improper handling of the scheduling class indicator (rq->next_class). This occurs when a queued task changes scheduling class but the scheduler fails to update the rescheduling indicators, leading to lost preemption signals and CPU idle loops.

Impact

The impact is that CPUs may idle while runnable tasks are waiting, leading to performance degradation and inefficient CPU utilization. This can affect system responsiveness and scheduling fairness but does not directly indicate privilege escalation or code execution risks.

Summary

This vulnerability in the Linux kernel scheduler arises from a race condition between __sched_setscheduler() and sched_change_end() for queued but non-running tasks. When a task is enqueued and then its scheduling class changes (e.g., from fair to real-time), the rq->next_class indicator is not updated properly, causing sched_balance_newidle() to incorrectly determine that no higher priority tasks are queued. Consequently, the CPU may idle even though runnable tasks exist. The fix involves calling wakeup_preempt() for queued tasks during class changes to re-evaluate rq->next_class and set the NEED_RESCHED flag, ensuring correct scheduling behavior.

References

Community reviews

Loading reviews…