Executive brief
A vulnerability in the Linux kernel's task scheduling system can cause a system to completely freeze (hard lockup). This occurs when specific high-priority background tasks become overloaded, leading the system into an infinite loop of internal signals. This could result in a total service outage for affected servers, requiring a physical or remote hard reboot to recover.
Technical details
A vulnerability in the Linux kernel's Real-Time (RT) scheduler, specifically within the load balancing logic, can trigger a CPU hard lockup. When a CPU is overloaded with RT tasks and other CPUs trigger load balancing via 'HAVE_RT_PUSH_IPI', a mismatch between 'rd->rto_loop' and 'rd->rto_loop_next' can occur. This mismatch forces 'rto_next_cpu()' to restart its search, incorrectly reselecting the current CPU. This results in the CPU queuing 'irq_work' to itself and sending continuous self-IPIs (Inter-Processor Interrupts), creating an infinite loop that prevents any other processing. The fix involves filtering the initiating CPU in 'rto_next_cpu()' to prevent redundant self-IPIs.
Affected products
- Linux Linux kernel Versions prior to 2026-03-04 patches (including various stable branches)
Timeline
- 2026-01-22: other: Patch submitted by Chen Jinghuang
- 2026-03-04: patched: Commits merged into various stable branches by Sasha Levin and Greg Kroah-Hartman
- 2026-05-27: advisory: CVE-2026-45919 published
References
- https://git.kernel.org/stable/c/16ca9f3117e9a294646c897daf08a5ab546c711b
- https://git.kernel.org/stable/c/3b3c672a66db3de3b40f8a7057864bc1f874ede3
- https://git.kernel.org/stable/c/52aeb1e07ec223caf212f036817976c98d2aa250
- https://git.kernel.org/stable/c/8ad5577b2d4acfd83f03d97a0aece2d18aac5f07
- https://git.kernel.org/stable/c/94894c9c477e53bcea052e075c53f89df3d2a33e
- https://git.kernel.org/stable/c/9f25edc5a20cb52a5abbf25f0724bb4732b81801
- https://git.kernel.org/stable/c/a6a73403733e86748421f2eeaf028c85683ef896