DEBIAN-CVE-2026-99217: Debian/linux vulnerability

Q: Under what conditions can this deadlock occur?

The deadlock requires a fork to fail while another thread closes a BPF link file descriptor. In that path, cleanup can wait on scheduler-extension disable work while holding the read side of scx_fork_rwsem, preventing the required write-side operation.

Q: What is the operational impact of triggering the issue?

The deadlock can block every fork on the system, not only the failing fork. This can prevent processes from being created until the condition is cleared or the system is recovered.

Q: Is this limited to forks that have already created a separate file table?

No. The affected cleanup concerns a failed fork before copy_files() has replaced the child task's inherited p->files pointer with its own file table. The fix clears that pointer early and only sets it explicitly when copy_files() handles CLONE_FILES.

Published Nov 2, 2026

Updated

In the Linux kernel, the following vulnerability has been resolved: fork: release the files of a failed fork after schedcancelfork() Reorder copyprocess() cleanup so schedfork() taking scxforkrwsem scxprefork() is safe and isn't held around exiting files. Right now, a fork that fails while another thread closed the bpf link fd will deadlock against its own read side. It also blocks every fork on the system: copyprocess() holds scxforkrwsem for read exitfiles() closefiles() filpclosesync() bpfscxunreg() kthreadflushwork() waits for the disable work scxrootdisable() percpudownwrite(&scxforkrwsem) Simply release the child's files after schedcancelfork() dropped the lock. The task starts out as a copy of its parent so p->files points to the parent's table until copyfiles() replaces it. exitfiles() must not run for a fork that failed before that. Clear p->files up front so exitfiles() is a no-op for those and make copyfiles() set it explicitly for CLONEFILES.

Affected Software

3 affected componentsFixes available

debian/linux*

debian/linux<6.12.115-1

6.12.115-1

debian/linux*

Event History

Nov 2, 2026

CVE Published

via OSV·04:17 PM

Data Sourced

via OSV·04:17 PM

DescriptionAffected Software

Frequently Asked Questions

Under what conditions can this deadlock occur?

The deadlock requires a fork to fail while another thread closes a BPF link file descriptor. In that path, cleanup can wait on scheduler-extension disable work while holding the read side of scx_fork_rwsem, preventing the required write-side operation.

What is the operational impact of triggering the issue?

The deadlock can block every fork on the system, not only the failing fork. This can prevent processes from being created until the condition is cleared or the system is recovered.

Is this limited to forks that have already created a separate file table?

No. The affected cleanup concerns a failed fork before copy_files() has replaced the child task's inherited p->files pointer with its own file table. The fix clears that pointer early and only sets it explicitly when copy_files() handles CLONE_FILES.

DEBIAN-CVE-2026-99217: Debian/linux vulnerability

Affected Software

Event History

Frequently Asked Questions

Under what conditions can this deadlock occur?

What is the operational impact of triggering the issue?

Is this limited to forks that have already created a separate file table?

Company

Resources

Contact

Frequently Asked Questions

Under what conditions can this deadlock occur?

What is the operational impact of triggering the issue?

Is this limited to forks that have already created a separate file table?