Always-Incorrect Control Flow Implementation in Linux kernel - CVE-2026-45919
Published: May 28, 2026
Vulnerability identifier: #VU132576
CSH Severity: Low
CVSS v4.0: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear
CVE-ID: CVE-2026-45919
CWE-ID: CWE-670
Exploitation vector: Local access
Exploit availability:
No public exploit available
Vendor: Linux Foundation
Affected software:
Linux kernel
Linux kernel
Detailed vulnerability description
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to improper logic in rto_next_cpu() when handling RT load balancing on an overloaded CPU. A local user can trigger repeated self-IPIs to cause a denial of service.
The issue can lead to a CPU hardlockup when HAVE_RT_PUSH_IPI is enabled and the affected CPU remains overloaded while other CPUs run pull_rt_task().
How to mitigate CVE-2026-45919
Install security update from vendor's repository.
Sources
- https://git.kernel.org/stable/c/16ca9f3117e9a294646c897daf08a5ab546c711b
- https://git.kernel.org/stable/c/3b3c672a66db3de3b40f8a7057864bc1f874ede3
- https://git.kernel.org/stable/c/52aeb1e07ec223caf212f036817976c98d2aa250
- https://git.kernel.org/stable/c/8ad5577b2d4acfd83f03d97a0aece2d18aac5f07
- https://git.kernel.org/stable/c/94894c9c477e53bcea052e075c53f89df3d2a33e
- https://git.kernel.org/stable/c/9f25edc5a20cb52a5abbf25f0724bb4732b81801
- https://git.kernel.org/stable/c/a6a73403733e86748421f2eeaf028c85683ef896
- https://git.kernel.org/stable/c/d57d0746276a88ea43a2cc62b849fd8a95e32e41