Executive brief
A vulnerability in the Linux kernel's task scheduler can cause a system crash (kernel panic) when certain types of new processes are created. This occurs because the system fails to properly reset internal timing data for new tasks, leading to mathematical errors that eventually cause the operating system to stop functioning. An exploit would result in a complete loss of system availability, requiring a reboot.
Technical details
A vulnerability in the Linux kernel scheduler (sched/fair) exists where __sched_fork() fails to clear the rel_deadline field when initializing forked entities. If a task is forked while rel_deadline is set, the first enqueue operation incorrectly treats the deadline as relative, resulting in an abnormally large absolute deadline. If the task subsequently calls sched_yield(), the inflated deadline is copied to vruntime, causing an integer overflow during weight multiplication in the enqueue path. This corrupts the CFS runqueue state (sum_w_vruntime) and EEVDF eligibility calculations, eventually causing pick_next_entity() to return NULL and triggering a NULL pointer dereference. The issue has been patched by ensuring rel_deadline is cleared during task initialization.
Affected products
- Linux Linux Kernel 82e9d0456e06cebe2c89f3c73cdbc9e3805e9437 to c71bf35caba12bfd9bc23e32b0bcd9e02d1cf1ac
Timeline
- 2026-04-24: disclosed: Initial patch submission by Zicheng Qu
- 2026-06-24: advisory: CVE-2026-52980 published