CVE-2026-43392

{"id": "CVE-2026-43392", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.5, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 1.8}]}, "affected": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "affectedData": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "8c2090c504e998c8f34ec870bae71dafcc96a6e0", "lessThan": "e0b14bf06393be137d3efb6a3b7cd5b4b9810a6b", "versionType": "git"}, {"status": "affected", "version": "8c2090c504e998c8f34ec870bae71dafcc96a6e0", "lessThan": "c44198f25fdfecc0ec0fe366bf8a47fe17d8e229", "versionType": "git"}, {"status": "affected", "version": "8c2090c504e998c8f34ec870bae71dafcc96a6e0", "lessThan": "05ab9ec5dc24f234e0a2fecf3e6ff937c68f7d81", "versionType": "git"}, {"status": "affected", "version": "8c2090c504e998c8f34ec870bae71dafcc96a6e0", "lessThan": "b06ccbabe2506fd70b9167a644978b049150224a", "versionType": "git"}], "programFiles": ["kernel/sched/ext.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "6.12"}, {"status": "unaffected", "version": "0", "lessThan": "6.12", "versionType": "semver"}, {"status": "unaffected", "version": "6.12.78", "versionType": "semver", "lessThanOrEqual": "6.12.*"}, {"status": "unaffected", "version": "6.18.20", "versionType": "semver", "lessThanOrEqual": "6.18.*"}, {"status": "unaffected", "version": "6.19.9", "versionType": "semver", "lessThanOrEqual": "6.19.*"}, {"status": "unaffected", "version": "7.0", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["kernel/sched/ext.c"], "defaultStatus": "affected"}]}], "published": "2026-05-08T15:16:50.583", "references": [{"url": "https://git.kernel.org/stable/c/05ab9ec5dc24f234e0a2fecf3e6ff937c68f7d81", "tags": ["Patch"], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/b06ccbabe2506fd70b9167a644978b049150224a", "tags": ["Patch"], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/c44198f25fdfecc0ec0fe366bf8a47fe17d8e229", "tags": ["Patch"], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/e0b14bf06393be137d3efb6a3b7cd5b4b9810a6b", "tags": ["Patch"], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "NVD-CWE-noinfo"}]}], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nsched_ext: Fix starvation of scx_enable() under fair-class saturation\n\nDuring scx_enable(), the READY -> ENABLED task switching loop changes the\ncalling thread's sched_class from fair to ext. Since fair has higher\npriority than ext, saturating fair-class workloads can indefinitely starve\nthe enable thread, hanging the system. This was introduced when the enable\npath switched from preempt_disable() to scx_bypass() which doesn't protect\nagainst fair-class starvation. Note that the original preempt_disable()\nprotection wasn't complete either - in partial switch modes, the calling\nthread could still be starved after preempt_enable() as it may have been\nswitched to ext class.\n\nFix it by offloading the enable body to a dedicated system-wide RT\n(SCHED_FIFO) kthread which cannot be starved by either fair or ext class\ntasks. scx_enable() lazily creates the kthread on first use and passes the\nops pointer through a struct scx_enable_cmd containing the kthread_work,\nthen synchronously waits for completion.\n\nThe workfn runs on a different kthread from sch->helper (which runs\ndisable_work), so it can safely flush disable_work on the error path\nwithout deadlock."}, {"lang": "es", "value": "En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nsched_ext: Soluciona la inanici\u00f3n de scx_enable() bajo saturaci\u00f3n de clase \u2019fair\u2019.\n\nDurante scx_enable(), el bucle de cambio de tareas READY -> ENABLED cambia la sched_class del hilo llamador de \u2019fair\u2019 a \u2019ext\u2019. Dado que \u2019fair\u2019 tiene mayor prioridad que \u2019ext\u2019, las cargas de trabajo de clase \u2019fair\u2019 que saturan pueden inanicionar indefinidamente al hilo de habilitaci\u00f3n, colgando el sistema. Esto se introdujo cuando la ruta de habilitaci\u00f3n cambi\u00f3 de preempt_disable() a scx_bypass(), lo que no protege contra la inanici\u00f3n de clase \u2019fair\u2019. Tenga en cuenta que la protecci\u00f3n original de preempt_disable() tampoco era completa; en modos de cambio parcial, el hilo llamador a\u00fan pod\u00eda sufrir inanici\u00f3n despu\u00e9s de preempt_enable(), ya que podr\u00eda haber sido cambiado a la clase \u2019ext\u2019.\n\nSe soluciona descargando el cuerpo de habilitaci\u00f3n a un kthread RT (SCHED_FIFO) dedicado a nivel de sistema que no puede sufrir inanici\u00f3n por tareas de clase \u2019fair\u2019 ni \u2019ext\u2019. scx_enable() crea el kthread de forma perezosa en el primer uso y pasa el puntero \u2019ops\u2019 a trav\u00e9s de una estructura scx_enable_cmd que contiene el kthread_work, luego espera sincr\u00f3nicamente la finalizaci\u00f3n.\n\nLa workfn se ejecuta en un kthread diferente de sch -> helper (que ejecuta disable_work), por lo que puede vaciar de forma segura disable_work en la ruta de error sin interbloqueo."}], "lastModified": "2026-11-11T20:10:00.273", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "FFE570BA-ED19-4D19-A3C1-74741F30770F", "versionEndExcluding": "6.12.78", "versionStartIncluding": "6.12.1"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "E5571059-6552-48E7-9BEF-3E358C387171", "versionEndExcluding": "6.18.20", "versionStartIncluding": "6.13"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "E825E7C3-FEAC-4FD3-8A81-78D7387948C9", "versionEndExcluding": "6.19.9", "versionStartIncluding": "6.19"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.12:-:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "0E698080-7669-4132-8817-4C674EEBCE54"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.12:rc2:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "925478D0-3E3D-4E6F-ACD5-09F28D5DF82C"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.12:rc3:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "3C95E234-D335-4B6C-96BF-E2CEBD8654ED"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.12:rc4:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "E0F717D8-3014-4F84-8086-0124B2111379"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.12:rc5:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "24DBE6C7-2AAE-4818-AED2-E131F153D2FA"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.12:rc6:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "24B88717-53F5-42AA-9B72-14C707639E3F"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.12:rc7:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "1EF8CD82-1EAE-4254-9545-F85AB94CF90F"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "F253B622-8837-4245-BCE5-A7BF8FC76A16"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64"}], "operator": "OR"}]}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}