CVE-2026-43326: sched_ext: Fix SCX_KICK_WAIT deadlock by deferring wait to balance callback
In the Linux kernel, the following vulnerability has been resolved:
schedext: Fix SCXKICKWAIT deadlock by deferring wait to balance callback
SCXKICKWAIT busy-waits in kickcpusirqworkfn() using smpcondloadacquire() until the target CPU's kicksync advances. Because the irqwork runs in hardirq context, the waiting CPU cannot reschedule and its own kicksync never advances. If multiple CPUs form a wait cycle, all CPUs deadlock.
Replace the busy-wait in kickcpusirqworkfn() with reschedcurr() to force the CPU through dopicktaskscx(), which queues a balance callback to perform the wait. The balance callback drops the rq lock and enables IRQs following the schedcorebalance() pattern, so the CPU can process IPIs while waiting. The local CPU's kicksync is advanced on entry to dopicktaskscx() and continuously during the wait, ensuring any CPU that starts waiting for us sees the advancement and cannot form cyclic dependencies.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2026-43326?
CVE-2026-43326 has been classified with a severity rating of high due to the potential for deadlock in the Linux kernel.
How do I fix CVE-2026-43326?
To fix CVE-2026-43326, update your Linux kernel to the latest stable version that includes the patch for this vulnerability.
What systems are affected by CVE-2026-43326?
CVE-2026-43326 affects various Linux kernel versions, specifically those that implemented the SCX_KICK_WAIT functionality.
What is the nature of the vulnerability in CVE-2026-43326?
CVE-2026-43326 is a deadlock vulnerability resulting from a busy-wait condition in the Linux kernel's kcpu handling.
Is CVE-2026-43326 actively being exploited?
As of now, there is no public information indicating that CVE-2026-43326 is being actively exploited in the wild.