CVE-2026-99217

Dashboard / Vulnerabilities / CVE-2026-99217

CVE-2026-99217

Summary: fork: release the files of a failed fork after sched_cancel_fork()

Details: In the Linux kernel, the following vulnerability has been resolved: fork: release the files of a failed fork after sched_cancel_fork() Reorder copy_process() cleanup so sched_fork() taking scx_fork_rwsem scx_pre_fork() is safe and isn't held around exiting files. Right now, a fork that fails while another thread closed the bpf link fd will deadlock against its own read side. It also blocks every fork on the system: copy_process() holds scx_fork_rwsem for read exit_files() close_files() filp_close_sync() bpf_scx_unreg() kthread_flush_work() waits for the disable work scx_root_disable() percpu_down_write(&scx_fork_rwsem) Simply release the child's files after sched_cancel_fork() dropped the lock. The task starts out as a copy of its parent so p->files points to the parent's table until copy_files() replaces it. exit_files() must not run for a fork that failed before that. Clear p->files up front so exit_files() is a no-op for those and make copy_files() set it explicitly for CLONE_FILES.

References: https://git.kernel.org/stable/c/14c7de6ca239326b79fd3f7aee55dfada1bb72ab, https://git.kernel.org/stable/c/27e1cbf8ec5f7117f6bb2d2e44030ac055f09097, https://git.kernel.org/stable/c/afa8eb069694bd9f845e5e44eac6e81cbc06780e, https://git.kernel.org/stable/c/f7ac8500d58e7684d37403553b1dea90ee2b27b1, https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/99xxx/CVE-2026-99217.json, https://nvd.nist.gov/vuln/detail/CVE-2026-99217, https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git