CVE-2026-93150: cgroup/cpuset: Make nr_deadline_tasks an atomic_t
In the Linux kernel, the following vulnerability has been resolved:
cgroup/cpuset: Make nrdeadlinetasks an atomict
The nrdeadlinetasks variable in the cpuset structure was introduced by commit 6c24849f5515 ("sched/cpuset: Keep track of SCHEDDEADLINE task in cpusets"). It is reported by sashiko [1] that nrdeadlinetasks can currently be modified by incdltaskscs() under rq->lock and by cpusetattach() under cpusetmutex. So if both updates happen simultaneously, the nrdeadlinetasks variable can be corrupted leading to incorrect operations down the road.
Fix that by changing its type to atomict so that nrdeadlinetasks are always atomically updated. This fix patch is a low hanging fruit. It can handle some of the races between a concurrent schedsetscheduler() and cpusetcanattach()/cpusetattach() calls, but not all of them like the other issue raised by sashiko [2]. This will be handled hopefully in a future follow up patch.
[1] https://sashiko.dev/#/patchset/20260626181923.133658-1-longman%40redhat.com [2] https://sashiko.dev/#/patchset/20260630033344.352702-1-longman%40redhat.com
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch 6c24849f5515 - Configuration
Change nr_deadline_tasks in the cpuset structure to atomic_t (per patch “cgroup/cpuset: Make nr_deadline_tasks an atomic_t”) to ensure updates are atomic and avoid corruption from concurrent sched/cpuset interactions.
Linux kernel cpuset nr_deadline_tasks type = atomic_t