CVE-2026-23371

Root

Cause

The vulnerability resides in the Linux kernel's SCHED_DEADLINE scheduler (kernel/sched/deadline.c). When a DEADLINE task that holds a PI mutex is changed to a lower scheduling class via sched_setscheduler(), the kernel may fail to set the ENQUEUE_REPLENISH flag during the subsequent enqueue operation. This occurs if the lock holder did not inherit DEADLINE parameters earlier (e.g., because it already had a shorter deadline than the donor). The missing flag leads to incorrect bandwidth accounting, which can manifest as a running_bw underflow warning and a kernel call trace [1].

Exploitation

Prerequisites

An attacker needs to be able to create and manipulate SCHED_DEADLINE tasks and PI mutexes, which requires sufficient privileges (e.g., capable of creating real-time tasks). The exploit scenario involves three steps: (1) a DEADLINE task (donor) blocks on a PI mutex held by another DEADLINE task (holder); (2) the holder is changed to a lower scheduling class via sched_setscheduler() while still holding the mutex; (3) the holder should inherit DEADLINE parameters from the donor with the ENQUEUE_REPLENISH flag, but this does not occur [1].

Impact

Successful exploitation can cause bandwidth accounting corruption in the deadline scheduler. This may lead to a kernel warning (as shown in the call trace) or, in more severe cases, system instability or denial-of-service conditions. The patch notes indicate that running stress-ng --schedpolicy 0 on an RT kernel can reproduce the warning, suggesting the issue is triggerable under specific workload conditions [1].

Mitigation

The fix introduces the function __setscheduler_dl_pi(), which detects when a DEADLINE task is de-boosted to a lower priority class. It ensures the task inherits the donor's DEADLINE parameters and sets the ENQUEUE_REPLENISH flag for proper bandwidth accounting. The patch has been committed to the Linux kernel stable tree (commit ba1c22924ddcc280672a2a06a9ca99ee3a1b92c3) [1][2]. Users should update to a kernel version containing this fix.