CVE-2026-99217

kernel: kernel: Denial of Service via deadlock during failed process creation

View on CVE.org

Published Nov 2, 2026 CVSS 3.1 · 4.1 Medium EPSS n/a KEV · Not listed

Description

This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

Affected Products

No data.

No data available yet.

Remediation

No solution or workaround provided in the CVE record

Tracking

Advisories

No advisories available

Metrics

No CVSS v4.0

Attack Vector Local

Attack Complexity High

Privileges Required High

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

No EPSS score available.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/14c7de6ca239326b79fd3f7aee55dfada1bb72ab
https://git.kernel.org/stable/c/27e1cbf8ec5f7117f6bb2d2e44030ac055f09097
https://git.kernel.org/stable/c/afa8eb069694bd9f845e5e44eac6e81cbc06780e
https://git.kernel.org/stable/c/f7ac8500d58e7684d37403553b1dea90ee2b27b1
https://nvd.nist.gov/vuln/detail/CVE-2026-99217
https://www.cve.org/CVERecord?id=CVE-2026-99217

History

Nov 3, 2026 7:30 PM Description updated. Title updated. Affected versions updated View changes

Type	Values Removed	Values Added
Description	In the Linux kernel, the following vulnerability has been resolved: fork: release the files of a failed fork after sched_cancel_fork() Reorder copy_process() cleanup so sched_fork() taking scx_fork_rwsem scx_pre_fork() is safe and isn't held around exiting files. Right now, a fork that fails while another thread closed the bpf link fd will deadlock against its own read side. It also blocks every fork on the system: copy_process() holds scx_fork_rwsem for read exit_files() close_files() filp_close_sync() bpf_scx_unreg() kthread_flush_work() waits for the disable work scx_root_disable() percpu_down_write(&scx_fork_rwsem) Simply release the child's files after sched_cancel_fork() dropped the lock. The task starts out as a copy of its parent so p->files points to the parent's table until copy_files() replaces it. exit_files() must not run for a fork that failed before that. Clear p->files up front so exit_files() is a no-op for those and make copy_files() set it explicitly for CLONE_FILES.	This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
Title	fork: release the files of a failed fork after sched_cancel_fork()	kernel: kernel: Denial of Service via deadlock during failed process creation
CPEs	cpe:2.3:o:linux:linux_kernel::::::::

Nov 3, 2026 2:45 AM Weaknesses updated View changes

Type	Values Removed	Values Added
Weaknesses	CWE-362

Nov 3, 2026 12:30 AM Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Weaknesses		CWE-833
References		https://nvd.nist.gov/vuln/detail/CVE-2026-99217 https://www.cve.org/CVERecord?id=CVE-2026-99217
Metrics	threat_severity `None`	cvssV3_1 `{'score': 4.1, 'vector': 'CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H'}` threat_severity `Moderate`

Nov 2, 2026 6:00 PM First appearance in the feed. Weaknesses updated. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Linux linux
Weaknesses		CWE-362
Vendors & Products		Linux linux

Nov 2, 2026 4:15 PM Description updated. Title updated. First appearance in the feed. Affected versions updated. Affected vendors updated. Added references View changes

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: fork: release the files of a failed fork after sched_cancel_fork() Reorder copy_process() cleanup so sched_fork() taking scx_fork_rwsem scx_pre_fork() is safe and isn't held around exiting files. Right now, a fork that fails while another thread closed the bpf link fd will deadlock against its own read side. It also blocks every fork on the system: copy_process() holds scx_fork_rwsem for read exit_files() close_files() filp_close_sync() bpf_scx_unreg() kthread_flush_work() waits for the disable work scx_root_disable() percpu_down_write(&scx_fork_rwsem) Simply release the child's files after sched_cancel_fork() dropped the lock. The task starts out as a copy of its parent so p->files points to the parent's table until copy_files() replaces it. exit_files() must not run for a fork that failed before that. Clear p->files up front so exit_files() is a no-op for those and make copy_files() set it explicitly for CLONE_FILES.
Title		fork: release the files of a failed fork after sched_cancel_fork()
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/14c7de6ca239326b79fd3f7aee55dfada1bb72ab https://git.kernel.org/stable/c/27e1cbf8ec5f7117f6bb2d2e44030ac055f09097 https://git.kernel.org/stable/c/afa8eb069694bd9f845e5e44eac6e81cbc06780e https://git.kernel.org/stable/c/f7ac8500d58e7684d37403553b1dea90ee2b27b1