CVE-2026-52980: sched/fair: Clear rel_deadline when initializing forked entities

Published Jun 24, 2026
·
Updated

In the Linux kernel, the following vulnerability has been resolved:

sched/fair: Clear reldeadline when initializing forked entities

A yield-triggered crash can happen when a newly forked schedentity enters the fair class with se->reldeadline unexpectedly set.

The failing sequence is:

1. A task is forked while se->reldeadline is still set. 2. schedfork() initializes vruntime, vlag and other schedentity state, but does not clear reldeadline. 3. On the first enqueue, enqueueentity() calls placeentity(). 4. Because se->reldeadline is set, placeentity() treats se->deadline as a relative deadline and converts it to an absolute deadline by adding the current vruntime. 5. However, the forked entity's deadline is not a valid inherited relative deadline for this new scheduling instance, so the conversion produces an abnormally large deadline. 6. If the task later calls schedyield(), yieldtaskfair() advances se->vruntime to se->deadline. 7. The inflated vruntime is then used by the following enqueue path, where the vruntime-derived key can overflow when multiplied by the entity weight. 8. This corrupts cfsrq->sumwvruntime, breaks EEVDF eligibility calculation, and can eventually make all entities appear ineligible. picknextentity() may then return NULL unexpectedly, leading to a later NULL dereference.

A captured trace shows the effect clearly. Before yield, the entity's vruntime was around:

9834017729983308

After yieldtaskfair() executed:

se->vruntime = se->deadline

the vruntime jumped to:

19668035460670230

and the deadline was later advanced further to:

19668035463470230

This shows that the deadline had already become abnormally large before yieldtaskfair() copied it into vruntime.

reldeadline is only meaningful when se->deadline really carries a relative deadline that still needs to be placed against vruntime. A freshly forked schedentity should not inherit or retain this state. Clear se->reldeadline in schedfork(), together with the other schedentity runtime state, so that the first enqueue does not interpret the new entity's deadline as a stale relative deadline.

Affected Software

5 affected components
Linux Linux kernel
Linux Linux kernel>=6.12<6.12.91
Linux Linux kernel>=6.13<6.18.33
Linux Linux kernel>=6.19<7.0.10
Linux Linux kernel=7.1-rc1

Event History

Jun 24, 2026
CVE Published
via MITRE·04:28 PM
Data Sourced
via MITRE·04:28 PM
Description
Data Sourced
via NVD·05:17 PM
RemedyDescriptionSeverityWeaknessAffected Software

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203