CVE-2026-93150

What it actually does

Concurrent non-atomic updates to the nr_deadline_tasks counter in cpuset structures from sched_setscheduler under rq->lock and cpuset_attach under cpuset_mutex can corrupt the variable value.

Why it matters to the business

May cause incorrect SCHED_DEADLINE task accounting leading to unexpected scheduling behavior or instability on systems using cpusets, with low likelihood of direct exploitation.

How an attack unfolds

An attacker with local access triggers simultaneous sched_setscheduler calls and cpuset attach operations to race on the shared counter, corrupting its value and potentially affecting downstream deadline task handling.

How to fix it

Apply kernel patches that change nr_deadline_tasks to atomic_t and use atomic operations for all updates.

How to confirm the fix worked

Review cpuset structure definition and inc_dl_tasks_cs/cpuset_attach functions to confirm atomic_t usage and atomic_inc/atomic_dec calls.

Typical attack path

1. Obtain local execution on affected kernel
2. Concurrently invoke sched_setscheduler on deadline tasks while performing cpuset attach/detach
3. Trigger data race on nr_deadline_tasks
4. Observe corrupted counter affecting task accounting

How to detect it

Examine kernel logs and crash dumps for errors related to cpuset deadline task counting or scheduling anomalies; no public exploitation artifacts are known.

What your security team should do

• Prioritize kernel updates containing the atomic_t fix for cpuset
• Restrict unprivileged cpuset and sched_setscheduler usage where possible
• Monitor kernel logs for scheduling anomalies in cpuset-enabled workloads