Linux Kernel Vulnerability Affecting CPU Hotplug Processes

CVE-2026-99085

What is CVE-2026-99085?

A vulnerability in the Linux kernel has been identified that affects CPU hotplug processes, leading to potential system hangs during the removal of a CPU. When a CPU is taken offline, tasks scheduled on it, especially those handled by the BPF scheduler, can impede the hotplug procedure and cause the system to stall. This occurs when a dying CPU’s task queue fails to empty, resulting in complications that either consume the task through another CPU or block progress if the task is strictly linked to the dying CPU. Subsequent re-enqueuing of tasks is necessary to ensure seamless operation during CPU hotplug actions. This fix addresses the complications caused by sched_ext in the task scheduling process.

References