CVE-2026-43417

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-43417", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-05-01T14:12:56.008Z", "datePublished": "2026-05-08T14:21:53.618Z", "dateUpdated": "2026-05-11T22:24:11.172Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-05-11T22:24:11.172Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nsched/mmcid: Handle vfork()/CLONE_VM correctly\n\nMatthieu and Jiri reported stalls where a task endlessly loops in\nmm_get_cid() when scheduling in.\n\nIt turned out that the logic which handles vfork()'ed tasks is broken. It\nis invoked when the number of tasks associated to a process is smaller than\nthe number of MMCID users. It then walks the task list to find the\nvfork()'ed task, but accounts all the already processed tasks as well.\n\nIf that double processing brings the number of to be handled tasks to 0,\nthe walk stops and the vfork()'ed task's CID is not fixed up. As a\nconsequence a subsequent schedule in fails to acquire a (transitional) CID\nand the machine stalls.\n\nCure this by removing the accounting condition and make the fixup always\nwalk the full task list if it could not find the exact number of users in\nthe process' thread list."}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["kernel/sched/core.c"], "versions": [{"version": "fbd0e71dc370af73f6b316e4de9eed273dd90340", "lessThan": "e6761cdce78a8919a537989afb6aaf6881469f83", "status": "affected", "versionType": "git"}, {"version": "fbd0e71dc370af73f6b316e4de9eed273dd90340", "lessThan": "28b5a1395036d6c7a6c8034d85ad3d7d365f192c", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["kernel/sched/core.c"], "versions": [{"version": "6.19", "status": "affected"}, {"version": "0", "lessThan": "6.19", "status": "unaffected", "versionType": "semver"}, {"version": "6.19.9", "lessThanOrEqual": "6.19.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.0", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.19", "versionEndExcluding": "6.19.9"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.19", "versionEndExcluding": "7.0"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/e6761cdce78a8919a537989afb6aaf6881469f83"}, {"url": "https://git.kernel.org/stable/c/28b5a1395036d6c7a6c8034d85ad3d7d365f192c"}], "title": "sched/mmcid: Handle vfork()/CLONE_VM correctly", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["kernel/sched/core.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "e6761cdce78a8919a537989afb6aaf6881469f83", "status": "affected", "version": "fbd0e71dc370af73f6b316e4de9eed273dd90340", "versionType": "git"}, {"lessThan": "28b5a1395036d6c7a6c8034d85ad3d7d365f192c", "status": "affected", "version": "fbd0e71dc370af73f6b316e4de9eed273dd90340", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["kernel/sched/core.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "6.19"}, {"lessThan": "6.19", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.19.*", "status": "unaffected", "version": "6.19.9", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.0", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "E825E7C3-FEAC-4FD3-8A81-78D7387948C9", "versionEndExcluding": "6.19.9", "versionStartIncluding": "6.19", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*", "matchCriteriaId": "F253B622-8837-4245-BCE5-A7BF8FC76A16", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*", "matchCriteriaId": "4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*", "matchCriteriaId": "F666C8D8-6538-46D4-B318-87610DE64C34", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nsched/mmcid: Handle vfork()/CLONE_VM correctly\n\nMatthieu and Jiri reported stalls where a task endlessly loops in\nmm_get_cid() when scheduling in.\n\nIt turned out that the logic which handles vfork()'ed tasks is broken. It\nis invoked when the number of tasks associated to a process is smaller than\nthe number of MMCID users. It then walks the task list to find the\nvfork()'ed task, but accounts all the already processed tasks as well.\n\nIf that double processing brings the number of to be handled tasks to 0,\nthe walk stops and the vfork()'ed task's CID is not fixed up. As a\nconsequence a subsequent schedule in fails to acquire a (transitional) CID\nand the machine stalls.\n\nCure this by removing the accounting condition and make the fixup always\nwalk the full task list if it could not find the exact number of users in\nthe process' thread list."}, {"lang": "es", "value": "En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nsched/mmcid: Manejar vfork()/CLONE_VM correctamente\n\nMatthieu y Jiri informaron bloqueos donde una tarea entra en un bucle infinito en mm_get_cid() al programar.\n\nResult\u00f3 que la l\u00f3gica que maneja las tareas vfork()\u2019eadas est\u00e1 rota. Se invoca cuando el n\u00famero de tareas asociadas a un proceso es menor que el n\u00famero de usuarios de MMCID. Luego recorre la lista de tareas para encontrar la tarea vfork()\u2019eada, pero tambi\u00e9n contabiliza todas las tareas ya procesadas.\n\nSi ese doble procesamiento reduce el n\u00famero de tareas a manejar a 0, el recorrido se detiene y el CID de la tarea vfork()\u2019eada no se corrige. Como consecuencia, una programaci\u00f3n posterior no logra adquirir un CID (transicional) y la m\u00e1quina se bloquea.\n\nSolucione esto eliminando la condici\u00f3n de contabilidad y haga que la correcci\u00f3n siempre recorra la lista completa de tareas si no pudo encontrar el n\u00famero exacto de usuarios en la lista de hilos del proceso."}], "id": "CVE-2026-43417", "lastModified": "2026-11-11T20:10:00.273", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2026-05-08T15:16:53.700", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/28b5a1395036d6c7a6c8034d85ad3d7d365f192c"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/e6761cdce78a8919a537989afb6aaf6881469f83"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "NVD-CWE-noinfo"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{"bugzilla": {"description": "kernel: sched/mmcid: Handle vfork()/CLONE_VM correctly", "id": "2468243", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2468243"}, "csaw": false, "cwe": "CWE-1095", "details": ["A flaw was found in the Linux kernel. The logic for handling tasks created using `vfork()` (a system call that creates a new process) contains an error. This can cause a task to enter an endless loop when attempting to acquire a Context ID (CID) during scheduling. A local user could exploit this vulnerability, leading to a system stall and a Denial of Service (DoS) for the affected machine."], "name": "CVE-2026-43417", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2026-05-08T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-43417\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-43417\nhttps://lore.kernel.org/linux-cve-announce/2026050845-CVE-2026-43417-e9af@gregkh/T"]}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[fbd0e71dc370af73f6b316e4de9eed273dd90340,e6761cdce78a8919a537989afb6aaf6881469f83)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[fbd0e71dc370af73f6b316e4de9eed273dd90340,28b5a1395036d6c7a6c8034d85ad3d7d365f192c)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "6.19"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[0,6.19)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.19.9,6.20.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.0,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-05-08T17:15:16.435662+00:00", "updated": "2026-05-26T16:30:10.052431+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}