Executive brief
The Linux kernel's process scheduler contains a flaw that can cause a system crash when running certain workloads. A u32 integer overflow in the task group runnable calculation leads to corrupted weight values, which eventually trigger a divide-by-zero error that crashes the kernel. This affects system stability and availability on affected Linux systems.
Technical details
A u32 integer overflow occurs in update_tg_cfs_runnable() when computing new_sum from se->avg.runnable_avg multiplied by divider. This corrupted value propagates through the scheduler's load tracking, eventually creating an insane large weight value that, when truncated to 32 bits by div_u64(), becomes zero. This zero divisor triggers a divide-by-zero crash in propagate_entity_load_avg(). The vulnerability is triggered by workloads like hackbench that stress the scheduler. The fix widens new_sum from u32 to u64 to prevent the overflow and corruption. No authentication, network access, or user interaction is required—only local execution of affected workloads.
Affected products
- Linux Linux Kernel 7.1.0-rc2 and earlier versions with vulnerable sched/fair code
Timeline
- 2026-09-17: disclosed: CVE-2026-93182 published