Deadlock in Linux kernel - CVE-2026-99217

Vulnerability details

The vulnerability allows a local user to cause a denial of service by blocking all process forks on the system.

The vulnerability exists due to improper lock ordering in copy_process() in kernel/fork.c when cleaning up a failed fork while another thread closes a BPF scheduler link file descriptor. A local user can trigger this concurrency condition to cause cleanup to wait for scheduler disable work that requires write access to scx_fork_rwsem while the failed fork still holds read access, resulting in a deadlock that blocks all process forks.

Affected software

How to mitigate CVE-2026-99217

External References

• https://git.kernel.org/stable/c/14c7de6ca239326b79fd3f7aee55dfada1bb72ab
• https://git.kernel.org/stable/c/27e1cbf8ec5f7117f6bb2d2e44030ac055f09097
• https://git.kernel.org/stable/c/afa8eb069694bd9f845e5e44eac6e81cbc06780e
• https://git.kernel.org/stable/c/f7ac8500d58e7684d37403553b1dea90ee2b27b1

Related Security Bulletins

• Deadlock in Linux kernel copy_process() in kernel/fork.c