Executive brief
The Linux kernel's cgroup/cpuset subsystem contains a race condition in how it tracks the number of real-time deadline tasks. When scheduler operations and cpuset attachment operations occur simultaneously, the task counter can become corrupted, potentially causing the kernel to mismanage real-time task resource allocations and lose track of scheduling constraints.
Technical details
The vulnerability is a data race in the nr_deadline_tasks variable within the cpuset structure. The variable is modified by inc_dl_tasks_cs() under the runqueue lock (rq->lock) and by cpuset_attach() under the cpuset mutex without synchronization between the two contexts. Concurrent calls to sched_setscheduler() and cpuset_attach() can cause simultaneous non-atomic updates, corrupting the counter. The fix converts nr_deadline_tasks from an int to atomic_t, ensuring all increments and decrements are atomic operations. This patch addresses a subset of the race condition issues; additional synchronization improvements may be needed for full protection.
Affected products
- Linux Linux kernel versions after commit 6c24849f5515 (sched/cpuset: Keep track of SCHED_DEADLINE task in cpusets)
Timeline
- 2026-09-17: disclosed: CVE-2026-93150 published
- 2026-07-02: patched: Upstream fix committed as 95220e1f18f6321008f021abc7d6f581f64bcb82