Junglewise Threat Intelligence

CVE-2026-64374: Linux Kernel live lock in RT task migration logic

CVE-2026-64374 · Severity: info · CVSS 0 · Published 2026-07-25

Technologies: Linux Kernel. Vendors: Linux.

Executive brief

A vulnerability in the Linux kernel's task scheduling system can cause a system to freeze or become unresponsive (live lock) under heavy network traffic. This occurs because the system gets stuck in a loop processing internal signals meant to balance high-priority tasks across processors. While the system is busy handling these signals, it cannot finish processing network data or start other tasks, effectively halting operations on affected processor cores.

Technical details

A live lock vulnerability exists in the Linux kernel's real-time (RT) task migration logic. In non-PREEMPT_RT kernels, softirqs run in interrupt context rather than threaded context. When a CPU is overloaded with RT tasks and simultaneously processing heavy softirq traffic (e.g., high network I/O), it may receive a continuous stream of Inter-Processor Interrupts (IPIs) from other CPUs attempting to trigger task migration. Because the softirq prevents the CPU from rescheduling, and the incoming IPIs further delay the completion of the softirq, the CPU can enter a state where it never returns to task context, effectively live locking. The fix disables the RT_PUSH_IPI feature by default on non-PREEMPT_RT kernels.

Affected products

  • Linux Linux Kernel All versions prior to the July 2026 patches

Timeline

  • 2026-05-06: other: Issue reported to kernel maintainers
  • 2026-05-15: other: Patch authored by Steven Rostedt
  • 2026-07-24: patched: Patch committed to stable tree
  • 2026-07-25: disclosed: CVE published

References

Related threats