CVE-2026-43323: Linux Kernel Race Condition Vulnerability

CVE-2026-43323 Overview

CVE-2026-43323 is a Linux kernel vulnerability in the Completely Fair Scheduler (CFS) sched/fair subsystem. The flaw stems from incomplete tracking of zero_vruntime after commit b3d99f43c72b ("sched/fair: Fix zero_vruntime tracking"). When two runnable tasks repeatedly call yield(), they can leapfrog each other through __enqueue_entity() and __dequeue_entity() paths from put_prev_task() and set_next_task() without ever advancing zero_vruntime. Only ticks and full enqueue/dequeue operations update that value. A local unprivileged user running a workload such as stress-ng-yield can drive virtual runtime past the overflow point within a single tick, destabilizing the host.

Critical Impact

A local user with low privileges can trigger scheduler virtual runtime overflow, producing a high-availability impact on the affected Linux host.

Affected Products

• Linux Kernel (mainline branches containing commit b3d99f43c72b)
• Linux Kernel stable trees prior to the fix commits 1319ea57, 87573883, c0891470, and fb61ffb3
• Distributions shipping kernels derived from the affected stable branches

Discovery Timeline

• 2026-05-08 - CVE-2026-43323 published to NVD
• 2026-05-15 - Last updated in NVD database

Technical Details for CVE-2026-43323

Vulnerability Analysis

The Linux CFS scheduler tracks each task's virtual runtime relative to a moving baseline called zero_vruntime. The earlier commit b3d99f43c72b removed updates to zero_vruntime from __enqueue_entity() and __dequeue_entity() when invoked via put_prev_task() and set_next_task(). After that change, only periodic ticks and full enqueue or dequeue operations advanced the baseline.

With two runnable tasks calling sched_yield() in a tight loop, neither task is fully dequeued. The scheduler swaps which task is eligible on every yield, and each yield promotes the runnable task by a full slice. The baseline never moves between context switches. The relative vruntime values drift unbounded until they overflow the signed comparison logic that drives scheduling decisions.

Root Cause

The root cause is missing baseline maintenance on the partial enqueue and dequeue paths used during yield-driven context switches. When cgroups are involved, the problem worsens because the periodic tick is not guaranteed to reach every cgroup promptly. A starved cgroup can accumulate scheduler state past safe bounds before a tick corrects it.

Attack Vector

Exploitation requires local code execution as an unprivileged user. An attacker launches multiple threads that call sched_yield() in a loop, similar to the stress-ng --yield workload that John used to bisect the regression. The compounding vruntime advancement reaches overflow within a single tick window, corrupting scheduling order and producing denial-of-service conditions on the host.

No verified public proof-of-concept exploit code has been published. See the upstream commits referenced under Kernel Git Commit fb61ffb for the corrective patch.

Detection Methods for CVE-2026-43323

Indicators of Compromise

• Kernel soft lockup warnings or RCU stall messages on hosts running yield-heavy workloads.
• Unexpected task starvation, scheduler latency spikes, or hung-task reports in dmesg involving CFS entities.
• Sudden process unresponsiveness on hosts where untrusted users can execute code, particularly when stress-ng or similar microbenchmarks are present.

Detection Strategies

• Compare uname -r output against the fixed kernel versions referenced in the upstream commits 1319ea57, 87573883, c0891470, and fb61ffb3.
• Monitor /proc/sched_debug for tasks with abnormally large or negative vruntime differentials relative to the cfs_rq baseline.
• Hunt for unprivileged processes invoking sched_yield() at high frequency through audit or eBPF instrumentation.

Monitoring Recommendations

• Alert on repeated kernel ring buffer entries containing sched:, soft lockup, or rcu_sched self-detected stall strings.
• Track CPU runqueue length and context-switch counts per cgroup; sustained anomalies on a single cgroup may indicate exploitation.
• Capture process telemetry for binaries known to invoke sched_yield() in tight loops on multi-tenant systems.

How to Mitigate CVE-2026-43323

Immediate Actions Required

• Inventory all Linux hosts running kernels that include commit b3d99f43c72b but not the fix commits listed in the NVD references.
• Prioritize patching multi-tenant systems, container hosts, and shared development infrastructure where untrusted local code can run.
• Restrict execution of scheduler stress tools such as stress-ng to administrative accounts until patches are applied.

Patch Information

The upstream fix forces zero_vruntime updates at the end of every slice, keeping the baseline within two lag bounds as documented in entity_key(). Apply the kernel updates that incorporate the changes from Kernel Git Commit 1319ea5, Kernel Git Commit 8757388, Kernel Git Commit c089147, and Kernel Git Commit fb61ffb. Coordinate with your distribution vendor for backported stable releases.

Workarounds

• Limit the number of runnable tasks per cgroup using cpu.max and cpu.weight to reduce the chance of two yield-bound tasks dominating a runqueue.
• Apply seccomp or AppArmor profiles that block or rate-limit sched_yield() for untrusted workloads where feasible.
• Reboot into a kernel build that reverts b3d99f43c72b if patched kernels are not yet available for your distribution.

# Verify the running kernel and check for the fix commits in the changelog
uname -r
zcat /proc/config.gz | grep CONFIG_FAIR_GROUP_SCHED
rpm -q --changelog kernel | grep -E '1319ea5|8757388|c089147|fb61ffb'
# Debian/Ubuntu equivalent
dpkg -l | grep linux-image
apt changelog linux-image-$(uname -r) | grep -E '1319ea5|8757388|c089147|fb61ffb'