Junglewise Threat Intelligence

CVE-2026-89991: Linux kernel infinite loop in pcpu_freelist push with one CPU

CVE-2026-89991 · Severity: info · Published 2026-09-16

Executive brief

The Linux kernel's BPF subsystem contains a logic error in memory management that can cause the system to hang indefinitely on single-CPU systems. When an interrupt handler tries to access a memory structure that is already locked by the interrupted code, the system enters an infinite loop and stops responding.

Technical details

The vulnerability exists in __pcpu_freelist_push() where an NMI context can re-enter while the interrupted context holds the current CPU's freelist lock. On systems with only one possible CPU (CONFIG_SMP=n, nr_cpus=1, or possible_cpus=1), the fallback loop iterates over cpu_possible_mask while skipping the current CPU, resulting in no candidates to examine. Since no lock acquisition attempt is made, the loop cannot progress and hangs indefinitely. The fix restores a pre-rqspinlock conversion extra fallback head that allows the push operation to succeed when the only per-CPU head is held by interrupted context, and updates the pop path to check this extra head for node reuse.

Affected products

  • Linux Linux kernel <UNKNOWN>

Timeline

  • 2026-09-16: disclosed

Related threats