CVE-2026-90432

Not scored yetLast modified Oct 19, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

sched_ext: Abort directly from the hardlockup handler

scx_hardlockup() defers the abort to an irq_work because exit claiming used to take scx_sched_lock and couldn't run from NMI. The deferral is now unnecessary - claiming is NMI-safe and asserting ->aborting is exactly what breaks the live-locks that hard-lock CPUs. Call handle_lockup() directly and drop the irq_work. This also makes the self-detected case recoverable: the perf watchdog fires on the hard-locked CPU itself, where a queued irq_work never runs with IRQs off.

Also fix the return value: %true used to be returned whenever sched_ext was loaded, suppressing the kernel's hardlockup report even when the abort was refused. Return %true only when this call initiated the abort.

Metrics

No CVSS score has been published yet.

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

No affected versions have been published.

Timeline

Published
Sep 17, 2026
Last modified
Oct 19, 2026
NVD status
Received

Related CVEs from 2026

CVE-2026-90433In the Linux kernel, the following vulnerability has been resolved: spi: oc-tiny: switch to managed controller allocation The controller iCVE-2026-90434In the Linux kernel, the following vulnerability has been resolved: isofs: release zisofs block pointer buffer head zisofs_fill_pages() reCVE-2026-904357.8In the Linux kernel, the following vulnerability has been resolved: RDMA/mlx5: Fix integer overflow of user QP buffer size set_user_buf_siCVE-2026-904387.2The Ninja Forms – The Contact Form Builder That Grows With You plugin for WordPress is vulnerable to Stored Cross-Site Scripting via ParagraCVE-2026-904396.5NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_v3_module module. When using HTTP/3 with OpenSSL versions <= OpenSSL 3CVE-2026-90448.0An OS command injection vulnerability exists in the VPN module of TP-Link AXE75 V1 routers. This vulnerability allows an adjacent, authenticCVE-2026-904408.2Uncaught exception, improper handling of exceptional conditions, improper resource shutdown vulnerability in Apache Thrift D thrift.server.nCVE-2026-904418.1A missing authorization vulnerability in the wgagent management daemon's session initialization function allows an authenticated, low-privilCVE-2026-904435.4A web interface reflects a portion of the request URL into a script context and a hyperlink attribute without adequate encoding, and does noCVE-2026-904448.8A file-transfer interface that requires valid credentials accepts attacker-controlled filenames without restricting shell metacharacters. AnCVE-2026-904456.5An interface that accepts file uploads from authenticated users extracts the contents of uploaded archives without validating that extractedCVE-2026-904464.3An application programming interface endpoint accepts a user-supplied value and interpolates it directly into the path of a backend request
CVE-2026-90432: Unscored | Vulnix