CVE-2026-45919sched/rt: Skip currently executing CPU in rto_next_cpu()
- 5.5MediumCVSS base score
- 0.13%Exploitation in 30 daysEPSS · top 97% of all CVEs
- NoKnown exploitednot in CISA's KEV catalog
- NonePublic exploitsnone known yet
Description
In the Linux kernel, the following vulnerability has been resolved: sched/rt: Skip currently executing CPU in rto_next_cpu() CPU0 becomes overloaded when hosting a CPU-bound RT task, a non-CPU-bound RT task, and a CFS task stuck in kernel space. When other CPUs switch from RT to non-RT tasks, RT load balancing (LB) is triggered; with HAVE_RT_PUSH_IPI enabled, they send IPIs to CPU0 to drive the execution of rto_push_irq_work_func. During push_rt_task on CPU0, if next_task->prio < rq->donor->prio, resched_curr() sets NEED_RESCHED and after the push operation completes, CPU0 calls rto_next_cpu(). Since only CPU0 is overloaded in this scenario, rto_next_cpu() should ideally return -1 (no further IPI needed). However, multiple CPUs invoking tell_cpu_to_push() during LB increments rd->rto_loop_next. Even when rd->rto_cpu is set to -1, the mismatch between rd->rto_loop and rd->rto_loop_next forces rto_next_cpu() to restart its search from -1. With CPU0 remaining overloaded (satisfying rt_nr_migratory && rt_nr_total > 1), it gets reselected, causing CPU0 to queue irq_work to itself and send self-IPIs repeatedly. As long as CPU0 stays overloaded and other CPUs run pull_rt_tasks(), it falls into an infinite self-IPI loop, which triggers a CPU hardlockup due to continuous self-interrupts. The trigging scenario is as follows: cpu0 cpu1 cpu2 pull_rt_task tell_cpu_to_push <------------irq_work_queue_on rto_push_irq_work_func push_rt_task resched_curr(rq) pull_rt_task rto_next_cpu tell_cpu_to_push <-------------------------- atomic_inc(rto_loop_next) rd->rto_loop != next rto_next_cpu irq_work_queue_on rto_push_irq_work_func Fix redundant self-IPI by filtering the initiating CPU in rto_next_cpu(). This solution has been verified to effectively eliminate spurious self-IPIs and prevent CPU hardlockup scenarios.
Timeline
ID reserved
By Linux
- 14 days later
· 14 days later
Published
- 5 months later
· 5 months later
Record updated
Changes after publication (a new score, a public exploit, EPSS crossing 1, 10 or 50 %, leaving KEV) are kept since November 2026; earlier ones are not known.
Scores
| Scored by | CVSS | Score | Vector |
|---|---|---|---|
| NVDNVD · Undergoing Analysis | 3.1 | Medium5.5 | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H |
- EPSS (exploitation in 30 days)
- 0.13% · top 97% of all CVEs (15 Nov 2026)
- CISA SSVC
- Exploitation: none · Automatable: no · Technical impact: partial
The list uses the assigner's score when there is one, then CISA's, then NVD's: Medium 5.5.
Affected products
- affected 4bdced5c9a2922521e325896a7bbbf0132c94e56 – < d57d0746276a88ea43a2cc62b849fd8a95e32e41
- affected 4bdced5c9a2922521e325896a7bbbf0132c94e56 – < 3b3c672a66db3de3b40f8a7057864bc1f874ede3
- affected 4bdced5c9a2922521e325896a7bbbf0132c94e56 – < 16ca9f3117e9a294646c897daf08a5ab546c711b
- affected 4bdced5c9a2922521e325896a7bbbf0132c94e56 – < 8ad5577b2d4acfd83f03d97a0aece2d18aac5f07
- affected 4bdced5c9a2922521e325896a7bbbf0132c94e56 – < a6a73403733e86748421f2eeaf028c85683ef896
- affected 4bdced5c9a2922521e325896a7bbbf0132c94e56 – < 52aeb1e07ec223caf212f036817976c98d2aa250
- affected 4bdced5c9a2922521e325896a7bbbf0132c94e56 – < 9f25edc5a20cb52a5abbf25f0724bb4732b81801
- affected 4bdced5c9a2922521e325896a7bbbf0132c94e56 – < 94894c9c477e53bcea052e075c53f89df3d2a33e
- affected cb1831a83e54cd3269a2420fce81c4fd8ae6f667
- affected 1c37ff78298a6b6063649123356a312e1cce12ca
- affected f17c786b28a3060a566a170c2cf3bd7441fc30a3
- affected 4.4.103 – < 4.5
- affected 4.9.66 – < 4.10
- affected 4.14.3 – < 4.15
- affected 4.15
- unaffected < 4.15
- unaffected 5.10.252 – ≤ 5.10.*
- unaffected 5.15.202 – ≤ 5.15.*
- unaffected 6.1.165 – ≤ 6.1.*
- unaffected 6.6.128 – ≤ 6.6.*
- unaffected 6.12.75 – ≤ 6.12.*
- unaffected 6.18.14 – ≤ 6.18.*
- unaffected 6.19.4 – ≤ 6.19.*
- unaffected 7.0 – ≤ *
References
References8
- https://git.kernel.org/stable/c/d57d0746276a88ea43a2cc62b849fd8a95e32e41 (opens in a new tab)
- https://git.kernel.org/stable/c/3b3c672a66db3de3b40f8a7057864bc1f874ede3 (opens in a new tab)
- https://git.kernel.org/stable/c/16ca9f3117e9a294646c897daf08a5ab546c711b (opens in a new tab)
- https://git.kernel.org/stable/c/8ad5577b2d4acfd83f03d97a0aece2d18aac5f07 (opens in a new tab)
- https://git.kernel.org/stable/c/a6a73403733e86748421f2eeaf028c85683ef896 (opens in a new tab)
- https://git.kernel.org/stable/c/52aeb1e07ec223caf212f036817976c98d2aa250 (opens in a new tab)
- https://git.kernel.org/stable/c/9f25edc5a20cb52a5abbf25f0724bb4732b81801 (opens in a new tab)
- https://git.kernel.org/stable/c/94894c9c477e53bcea052e075c53f89df3d2a33e (opens in a new tab)
Sources
The same CVE in the primary databases and aggregators, to check against.
- CVE.org record (opens in a new tab)
- CVE List JSON (GitHub) (opens in a new tab)
- NVD (opens in a new tab)
- FIRST EPSS (opens in a new tab)
- EUVD EUVD-2026-32385 (opens in a new tab)
- OSV.dev (opens in a new tab)
- GitHub Advisories (opens in a new tab)
- CIRCL Vulnerability-Lookup (opens in a new tab)
Badge for a README or a ticket
[](https://cveledger.app/cve/CVE-2026-45919)Record last updated .