CVE-2026-43418: sched/mmcid: Prevent CID stalls due to concurrent forks
In the Linux kernel, the following vulnerability has been resolved:
sched/mmcid: Prevent CID stalls due to concurrent forks
A newly forked task is accounted as MMCID user before the task is visible in the process' thread list and the global task list. This creates the following problem:
CPU1 CPU2 fork() schedmmcidfork(tnew1) tnew1->mm.mmcidusers++; tnew1->mmcid.cid = getcid() -> preemption fork() schedmmcidfork(tnew2) tnew2->mm.mmcidusers++; // Reaches the per CPU threshold mmcidfixuptaskstocpus() foreachother(current, p) ....
As tnew1 is not visible yet, this fails to fix up the already allocated CID of tnew1. As a consequence a subsequent schedule in might fail to acquire a (transitional) CID and the machine stalls.
Move the invocation of schedmmcidfork() after the new task becomes visible in the thread and the task list to prevent this.
This also makes it symmetrical vs. exit() where the task is removed as CID user before the task is removed from the thread and task lists.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.19.10-1 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.1.176-1Fixed in 6.1.190-1Fixed in 6.12.107-1Fixed in 6.12.116-1Fixed in 7.2.15-1Fixed in 7.3.4-1 - Compensating control
Move the invocation of sched_mm_cid_fork() until after the newly forked task becomes visible in the process thread list and global task list, preventing CID stalls due to concurrent forks.
Event History
Frequently Asked Questions
What level of access is required to trigger this issue?
The CVSS vector indicates local access with low privileges is required. No user interaction is required.
What conditions are needed for exploitation?
The failure depends on concurrent fork activity that causes MMCID user accounting to reach a per-CPU threshold while a newly forked task is not yet visible in the process thread list or global task list.
What is the operational impact?
A subsequent task schedule-in can fail to acquire a transitional CID, causing the machine to stall. The CVSS assessment rates availability impact as high, with no confidentiality or integrity impact.
What remediation is available?
A patch is available. The fix moves MMCID fork accounting until after the new task is visible in the thread and task lists, allowing CID fixup processing to find it.