Linux Kernel Fork Deadlock via Failed Fork & BPF Link FD
CVE-2026-99217 Published on November 2, 2026
fork: release the files of a failed fork after sched_cancel_fork()
In the Linux kernel, the following vulnerability has been resolved:
fork: release the files of a failed fork after sched_cancel_fork()
Reorder copy_process() cleanup so sched_fork() taking scx_fork_rwsem
scx_pre_fork() is safe and isn't held around exiting files. Right now, a
fork that fails while another thread closed the bpf link fd will
deadlock against its own read side. It also blocks every fork on the
system:
copy_process() holds scx_fork_rwsem for read
exit_files()
close_files()
filp_close_sync()
bpf_scx_unreg()
kthread_flush_work() waits for the disable work
scx_root_disable()
percpu_down_write(&scx_fork_rwsem)
Simply release the child's files after sched_cancel_fork() dropped the
lock. The task starts out as a copy of its parent so p->files points to
the parent's table until copy_files() replaces it. exit_files() must not
run for a fork that failed before that. Clear p->files up front so
exit_files() is a no-op for those and make copy_files() set it
explicitly for CLONE_FILES.
Products Associated with CVE-2026-99217
Want to know whenever a new CVE is published for Linux Kernel? stack.watch will email you.
Affected Versions
Linux:- Version 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 and below 27e1cbf8ec5f7117f6bb2d2e44030ac055f09097 is affected.
- Version 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 and below f7ac8500d58e7684d37403553b1dea90ee2b27b1 is affected.
- Version 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 and below 14c7de6ca239326b79fd3f7aee55dfada1bb72ab is affected.
- Version 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 and below afa8eb069694bd9f845e5e44eac6e81cbc06780e is affected.
- Before 6.12.115 is affected.
- Before 6.18.60 is affected.
- Before 7.2.14 is affected.
- Before 7.3.1 is affected.
- Version 6.12.115, <= 6.12.* is unaffected.
- Version 6.18.60, <= 6.18.* is unaffected.
- Version 7.2.14, <= 7.2.* is unaffected.
- Version 7.3.1, <= 7.3.* is unaffected.