Cloudanix VulnDB

CVE-2026-93182

None

CVSS

—

EPSS

0.2%

Published

Sep 17, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A bug in the Linux kernel scheduler can make the system crash when many tasks are rapidly started and stopped.

Exploitation
Local Privilege
Attacker needs
Local User
Complexity
Low
Impact
Denial Of Service
Component
OS kernel
Class
Memory Corruption
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

Integer overflow in update_tg_cfs_runnable() corrupts runnable_sum values passed through tg_tasks() and reweight_entity(), resulting in an insane cfs_rq->load.weight that triggers divide-by-zero in propagate_entity_load_avg() during CFS load balancing.

Why it matters to the business

Local workloads performing frequent task enqueue/dequeue operations can cause kernel panics and system instability, leading to service outages on Linux hosts without requiring elevated privileges.

How an attack unfolds

An attacker runs or induces a workload that exercises tg_tasks() paths in the fair scheduler (such as hackbench-style pipe or thread activity). The u32 truncation in new_sum produces a negative or zero divider; subsequent load propagation reaches div_u64 with a truncated weight of zero, crashing the kernel.

How to fix it

Upgrade the Linux kernel to a version containing the widened u64 new_sum fix in update_tg_cfs_runnable(). Apply the stable backport for the affected series; no configuration workaround exists.

How to confirm the fix worked

Confirm the kernel version contains the u64 widening change; re-run scheduler stress workloads such as hackbench and verify absence of the propagate_entity_load_avg divide-by-zero stack trace.

Typical attack path

  1. Trigger scheduler load balancing via concurrent task creation/deletion
  2. Force tg_tasks() long-to-int truncation yielding negative nr_tasks
  3. Corrupt se->load.weight and cfs_rq->load.weight via reweight_entity()
  4. Reach propagate_entity_load_avg() and trigger div_u64 divide-by-zero

How to detect it

Search kernel logs for the propagate_entity_load_avg divide-by-zero RIP and the associated dequeue_task_fair / __schedule stack trace; correlate with sudden process terminations or container restarts on affected kernels.

  • propagate_entity_load_avg+0x35f/0x3e0
  • divide-by-zero in update_tg_cfs_runnable
  • CPU:.*PID:.*Comm:.*hackbench.*Not tainted

What your security team should do

  • Prioritize kernel updates on all multi-tenant and high-availability Linux systems within normal patch cycles
  • Monitor for scheduler-related oops/panic reports in system logs
  • Test the fix in staging environments using synthetic CFS load generators before broad deployment

The record

In the Linux kernel, the following vulnerability has been resolved: sched/fair: Fix overflow in update_tg_cfs_runnable() A divide-by-zero crash is observed when running hackbench: [14697.488452] CPU: 112 UID: 0 PID: 124791 Comm: hackbench Not tainted 7.1.0-rc2+ [14697.492627] RIP: 0010:propagate_entity_load_avg+0x35f/0x3e0 [14697.506799] <TASK> [14697.507411] __dequeue_task+0x2b4/0xc70 [14697.508677] dequeue_task_fair+0x36/0x370 [14697.509047] dequeue_task+0x101/0x2f0 [14697.509426] __schedule+0x1b1/0x1a00 [14697.510868] anon_pipe_read+0x3da/0x450 [14697.511400] vfs_read+0x361/0x390 [14697.512053] __x64_sys_read+0x19/0x30 The divide-by-zero happens here: if (scale_load_down(gcfs_rq->load.weight)) { load_sum = div_u64(gcfs_rq->avg.load_sum, scale_load_down(gcfs_rq->load.weight)); } gcfs_rq->load.weight is an insane large value and is truncated to the lower 32 bits by div_u64, which happen to be 0. Using AI for investigation, the cause is a u32 overflow in update_tg_cfs_runnable(), and flat pickup became a victim when using tg_tasks(): u32 new_sum, divider; ... new_sum = se->avg.runnable_avg * divider; <-- boom The following sequence shows how this triggers the crash: propagate_entity_load_avg() update_tg_cfs_runnable() # u32 overflow corrupts runnable_sum __update_load_avg_cfs_rq() ___update_load_avg() # computes insane runnable_avg update_tg_load_avg() # propagates to tg->runnable_avg update_cfs_group() calc_concur_shares() tg_tasks() # long-to-int truncation, negative nr reweight_entity() # corrupted se->load.weight update_load_add() # corrupted cfs_rq->load.weight propagate_entity_load_avg() update_tg_cfs_load() div_u64() # divide-by-zero Fix by widening new_sum from u32 to u64 (no need to force tg_tasks() to return unsigned long after this fix)

Affected packages

Ecosystem Package Introduced Fixed