{"apiVersion":"1.0","identifier":"CVE-2026-99085","description":"In the Linux kernel, the following vulnerability has been resolved: sched_ext: Fix CPU hotplug hang when a dying CPU-s tasks sit in the BPF scheduler A CPU going down has to empty its own rq. Its hotplug thread waits in sched_cpu_wait_empty() until nothing else is left, and the only thing that wakes it is balance_push(), which runs from __schedule() on the dying CPU and pushes off the migratable tasks the CPU picks. sched_ext breaks this. A task sitting on a user DSQ or held by the BPF scheduler is still counted on its rq, but an inactive CPU no longer calls ops.dispatch() and can-t pull the task back. The dying CPU goes idle with the task still counted, and one of two things happens: - Another CPU consumes the task. The rq empties without a __schedule() on the dying CPU, so the hotplug thread is never woken and cpu_down() hangs holding cpu_hotplug_lock. - The task is affine only to the dying CPU. Nothing can move it, and the offline stalls until the watchdog ejects the BPF scheduler. When the rq goes offline, re-enqueue every task on it that isn-t already on the local DSQ. An enqueue on an offline rq lands on the local DSQ, so the dying CPU itself picks the tasks and balance_push() pushes them off, the same as for the other sched classes. From then on no sched_ext path on another CPU can pull a task off the rq. ops.dispatch() currently stops as soon as the CPU goes inactive, and CPU hotplug then waits for an RCU grace period before taking the rq offline. A BPF-held task affine only to the dying CPU and preempted inside an RCU read-side critical section would block that grace period, and the rq would never go offline. Test SCX_RQ_ONLINE directly so that ops.dispatch() keeps running until the rq goes offline. Only the dying CPU-s own hotplug thread clears the flag during teardown, and task_can_run_on_remote_rq() still keeps other rqs- tasks off the CPU.","publishedAt":"2026-10-23T13:17:32","lastModifiedAt":"2026-10-23T13:17:32","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-99085","cvssScore":null,"cvssVector":null,"epssProbability":0.00164,"riskScore":null,"affectedProduct":"Linux kernel","affectedVersions":"unknown","vulnerabilityType":"Kernel","operatingSystems":[],"links":{"self":"https://www.redsauce.net/api/cves/CVE-2026-99085","webPages":{"es":"https://www.redsauce.net/es/cves/CVE-2026-99085","en":"https://www.redsauce.net/en/cves/CVE-2026-99085","fr":"https://www.redsauce.net/fr/cves/CVE-2026-99085","pt":"https://www.redsauce.net/pt/cves/CVE-2026-99085","de":"https://www.redsauce.net/de/cves/CVE-2026-99085","sk":"https://www.redsauce.net/sk/cves/CVE-2026-99085","el":"https://www.redsauce.net/el/cves/CVE-2026-99085"},"source":"https://nvd.nist.gov/vuln/detail/CVE-2026-99085"}}