SB20261029215 - Insufficient Control Flow Management in Linux kernel sched

Description

This security bulletin contains information about 1 vulnerability.

1) Insufficient Control Flow Management (CVE-ID: CVE-2026-99105)

CWE-ID: CWE-691 - Insufficient Control Flow Management

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service by stalling runnable tasks.

The vulnerability exists due to improper control flow management in the Linux kernel sched_ext function put_prev_task_scx() when a task enqueued with SCX_ENQ_LAST returns to its CPU's local dispatch queue after the scheduler has selected the idle task. A local user can trigger affected task scheduling paths under a scheduler using SCX_OPS_ENQ_LAST to leave runnable tasks queued while the CPU remains idle until an unrelated wakeup or watchdog intervention.

Remediation

Install update from vendor's website.

References

• https://git.kernel.org/stable/c/396ba6f04da3fd1fb5a3d1c9535bef3f967f4e59
• https://git.kernel.org/stable/c/7a9df76679633cf26e0fea882a684012c6ec245a
• https://git.kernel.org/stable/c/8d891c218016b6145993e082e7f732cb69dd0e29