Executive brief
A flaw in the Linux kernel's task scheduling logic can cause the system to stop responding or "stall." This occurs when specific types of new processes are created, leading the system to enter an infinite loop while trying to manage memory identifiers. An exploit could allow a local user to trigger a denial-of-service, effectively halting system operations and requiring a reboot.
Technical details
The vulnerability exists in the mm_get_cid() function within the Linux kernel scheduler. The logic responsible for handling vfork()'ed tasks (CLONE_VM) incorrectly accounts for tasks when walking the process thread list to fix up Memory Management Context IDs (MMCID). If the accounting logic prematurely stops the task list walk, a vfork'ed task may fail to acquire a valid CID. This results in the task entering an endless loop during the 'schedule in' phase, leading to a kernel stall and local denial-of-service. The fix involves removing the faulty accounting condition to ensure the full task list is processed during CID fixups.
Affected products
- Linux Linux kernel 6.19 to 6.19.9
Timeline
- 2026-03-10: patched: Initial patch by Thomas Gleixner
- 2026-05-08: disclosed: CVE published by kernel.org
- 2026-05-22: advisory: NVD analysis and enrichment