UBUNTU-CVE-2026-93182: Medium severity ubuntu/linux-hwe-edge vulnerability

In the Linux kernel, the following vulnerability has been resolved: sched/fair: Fix overflow in updatetgcfsrunnable() A divide-by-zero crash is observed when running hackbench: [14697.488452] CPU: 112 UID: 0 PID: 124791 Comm: hackbench Not tainted 7.1.0-rc2+ [14697.492627] RIP: 0010:propagateentityloadavg+0x35f/0x3e0 [14697.506799] <TASK> [14697.507411] dequeuetask+0x2b4/0xc70 [14697.508677] dequeuetaskfair+0x36/0x370 [14697.509047] dequeuetask+0x101/0x2f0 [14697.509426] schedule+0x1b1/0x1a00 [14697.510868] anonpiperead+0x3da/0x450 [14697.511400] vfsread+0x361/0x390 [14697.512053] x64sysread+0x19/0x30 The divide-by-zero happens here: if (scaleloaddown(gcfsrq->load.weight)) { loadsum = divu64(gcfsrq->avg.loadsum, scaleloaddown(gcfsrq->load.weight)); } gcfsrq->load.weight is an insane large value and is truncated to the lower 32 bits by divu64, which happen to be 0. Using AI for investigation, the cause is a u32 overflow in updatetgcfsrunnable(), and flat pickup became a victim when using tgtasks(): u32 newsum, divider; ... newsum = se->avg.runnableavg divider; <-- boom The following sequence shows how this triggers the crash: propagateentityloadavg() updatetgcfsrunnable() # u32 overflow corrupts runnablesum updateloadavgcfsrq() updateloadavg() # computes insane runnableavg updatetgloadavg() # propagates to tg->runnableavg updatecfsgroup() calcconcurshares() tgtasks() # long-to-int truncation, negative nr reweightentity() # corrupted se->load.weight updateloadadd() # corrupted cfsrq->load.weight propagateentityloadavg() updatetgcfsload() divu64() # divide-by-zero Fix by widening newsum from u32 to u64 (no need to force tgtasks() to return unsigned long after this fix)