CVE-2026-52980: Linux Kernel Fair Scheduler Crash via Fork and Yield

Technical summary

The Linux kernel's EEVDF (Earliest Eligible Virtual Deadline First) fair scheduler contains a state initialization bug in the process fork path. When __sched_fork() initializes a new scheduling entity, it clears vruntime and vlag but neglects to clear the rel_deadline flag. This flag signals to place_entity() that a deadline value is relative and must be converted to an absolute deadline by addition with current vruntime. In a forked task, this flag remains stale, causing place_entity() to misinterpret the inherited (uninitialized or residual) deadline as a relative value. The conversion produces an abnormally large absolute deadline. If the forked task later invokes sched_yield(), yield_task_fair() copies this inflated deadline into se->vruntime. The oversized vruntime, when multiplied by task weight during subsequent enqueue operations, overflows the sum_w_vruntime accumulator, corrupting the fair scheduling queue's weighted virtual runtime tracking. This breaks EEVDF eligibility calculations, potentially marking all entities as ineligible and causing pick_next_entity() to return NULL, leading to NULL dereference crashes in the scheduler core.

Business impact

This vulnerability can cause local denial of service on Linux systems through unexpected kernel crashes affecting system stability and availability. In multi-tenant environments—including shared hosting, containerized deployments, and virtual private servers—an unprivileged user can crash the host kernel, disrupting all workloads. The attack surface includes any application that forks child processes and performs yield operations, making it relevant to web applications, microservices, and development tools. Cloud providers and managed service operators face risk to service availability SLAs. The crash occurs in the scheduler's critical path, so exploitation is difficult to detect or prevent at the application layer.

Affected systems

The vulnerability affects the Linux kernel scheduler's fair class implementation. It impacts all Linux distributions and systems using the mainline kernel or derivatives with the EEVDF scheduler. The flaw was introduced as part of kernel scheduling improvements and affects systems where unprivileged users can create processes and invoke scheduler operations. Containerized and multi-user Linux systems face elevated risk due to broader attack surface.

Exploitability

Exploitation requires local access and unprivileged execution privileges. An attacker would need to craft or identify a workload sequence combining process forking with explicit yield operations under specific timing or load conditions to reliably trigger the scheduler state corruption. The vulnerability is not remotely exploitable and does not require special kernel capabilities. However, the likelihood of accidental triggering by normal application behavior (fork + yield patterns) increases risk in production environments running diverse workloads.

Remediation

The fix involves ensuring that rel_deadline is explicitly cleared when a new scheduling entity is initialized during process fork, preventing the flag from carrying stale state into the forked task's first scheduler enqueue. This is a surgical change to __sched_fork() to zero the rel_deadline field alongside other per-entity runtime state. Vendors and distribution maintainers should apply the corrective patch to affected kernel versions and test against existing scheduler test suites to verify no regressions in EEVDF behavior.

Patch guidance

Check your Linux distribution's security advisory and kernel update channels for patched versions. Verify against the vendor advisory to confirm the specific kernel versions that receive the fix. Most distributions will backport the fix into currently supported stable kernel series. Update to the patched kernel version when available and perform a system reboot to apply the changes. Test applications that heavily use process forking and yield to confirm no unintended behavioral changes.

Detection guidance

Monitor system logs for unexpected kernel crashes related to the scheduler or pick_next_entity function returning NULL. Kernel Oops or BUG messages mentioning fair.c or the EEVDF scheduler are indicators. Enable kernel crash dump (kdump/kexec) to capture detailed kernel logs during failures. In production, track kernel panic events and correlate them with workload patterns involving fork and yield operations. Threat hunting can examine process creation patterns on multi-user systems to identify potential trigger scenarios, though the attack requires deliberate action and is unlikely to occur randomly.

Why prioritize this

This vulnerability merits prioritization for systems running vulnerable kernel versions in multi-user or containerized environments where unprivileged users have process execution rights. While the attack surface is local and exploitation is non-trivial, the impact is a kernel crash affecting all running processes. Organizations should prioritize patching if they operate shared Linux infrastructure, support user code execution, or run Kubernetes and other containerization platforms. Systems with strict user access controls and no process execution by untrusted code face lower risk.

Risk score, explained

The CVSS 3.1 score of 5.5 (MEDIUM) reflects the local attack requirement, unprivileged access threshold, and denial-of-service impact without confidentiality or integrity loss. The score does not fully capture the reliability or likelihood of exploitation—triggering the race condition requires specific forking and yield patterns that may occur reliably under known conditions or require attacker setup. In environments where user code execution is unavoidable, the practical risk may exceed the base score. Organizational risk depends heavily on the attack surface (number of unprivileged users or containers) and system availability tolerance.

Frequently asked questions