UBUNTU-CVE-2026-99217: Medium severity ubuntu/linux vulnerability
In the Linux kernel, the following vulnerability has been resolved: fork: release the files of a failed fork after schedcancelfork() Reorder copyprocess() cleanup so schedfork() taking scxforkrwsem scxprefork() is safe and isn't held around exiting files. Right now, a fork that fails while another thread closed the bpf link fd will deadlock against its own read side. It also blocks every fork on the system: copyprocess() holds scxforkrwsem for read exitfiles() closefiles() filpclosesync() bpfscxunreg() kthreadflushwork() waits for the disable work scxrootdisable() percpudownwrite(&scxforkrwsem) Simply release the child's files after schedcancelfork() dropped the lock. The task starts out as a copy of its parent so p->files points to the parent's table until copyfiles() replaces it. exitfiles() must not run for a fork that failed before that. Clear p->files up front so exitfiles() is a no-op for those and make copyfiles() set it explicitly for CLONEFILES.
Affected Software
Event History
Frequently Asked Questions
What conditions are required to trigger the deadlock?
A fork must fail while another thread closes a BPF link file descriptor. The failure path can then close files while holding scx_fork_rwsem for read, conflicting with scheduler extension disable work that needs the same lock for write.
What is the practical impact on a host?
The deadlock can block every fork on the system, not just the process that encountered the failed fork. This can prevent new processes from being created while the condition persists.
Which Ubuntu kernel packages are listed as affected?
The listed packages are ubuntu/linux, ubuntu/linux-fips, ubuntu/linux-aws, ubuntu/linux-azure, ubuntu/linux-gcp, ubuntu/linux-oracle, ubuntu/linux-aws-fips, and ubuntu/linux-azure-fips.