SB2026110329 - Deadlock in Linux kernel copy_process() in kernel/fork.c

Description

This security bulletin contains information about 1 vulnerability.

1) Deadlock (CVE-ID: CVE-2026-99217)

CWE-ID: CWE-833 - Deadlock

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service by blocking all process forks on the system.

The vulnerability exists due to improper lock ordering in copy_process() in kernel/fork.c when cleaning up a failed fork while another thread closes a BPF scheduler link file descriptor. A local user can trigger this concurrency condition to cause cleanup to wait for scheduler disable work that requires write access to scx_fork_rwsem while the failed fork still holds read access, resulting in a deadlock that blocks all process forks.

Remediation

Install update from vendor's website.

References

• https://git.kernel.org/stable/c/14c7de6ca239326b79fd3f7aee55dfada1bb72ab
• https://git.kernel.org/stable/c/27e1cbf8ec5f7117f6bb2d2e44030ac055f09097
• https://git.kernel.org/stable/c/afa8eb069694bd9f845e5e44eac6e81cbc06780e
• https://git.kernel.org/stable/c/f7ac8500d58e7684d37403553b1dea90ee2b27b1