CVE-2026-52980: Linux Kernel Privilege Escalation Flaw

CVE-2026-52980 Overview

CVE-2026-52980 is a Linux kernel vulnerability in the Completely Fair Scheduler (CFS) fair-class scheduling code. The flaw resides in the handling of a newly forked sched_entity whose rel_deadline field is not cleared during __sched_fork(). When the entity is first enqueued, place_entity() interprets a stale value in se->deadline as a relative deadline and converts it into an inflated absolute deadline. A subsequent sched_yield() copies that inflated deadline into se->vruntime, corrupts cfs_rq->sum_w_vruntime, and breaks Earliest Eligible Virtual Deadline First (EEVDF) eligibility calculations. pick_next_entity() can then return NULL, leading to a kernel NULL pointer dereference and crash.

Critical Impact
A local unprivileged process can trigger a kernel NULL pointer dereference and denial of service by forking and calling sched_yield() under the affected scheduler logic.

Affected Products

Linux kernel mainline branches containing the EEVDF fair-class scheduler with rel_deadline support
Stable kernel trees referenced by commits 3da56dc, 8f4a162, c71bf35, and f3c16e1
Distributions shipping unpatched derivatives of these kernel branches

Discovery Timeline

2026-06-24 - CVE-2026-52980 published to NVD
2026-06-24 - Last updated in NVD database

Technical Details for CVE-2026-52980

Vulnerability Analysis

The issue lives in kernel/sched/fair.c and kernel/sched/core.c within the EEVDF scheduling path. __sched_fork() initializes runtime state for a new sched_entity, including vruntime and vlag, but it does not reset se->rel_deadline. A forked task therefore carries a stale rel_deadline flag into the fair class.

During the first enqueue, enqueue_entity() calls place_entity(). Because rel_deadline is set, the function treats se->deadline as a relative offset and adds the current vruntime, producing an abnormally large absolute deadline. A captured trace shows vruntime jumping from 9834017729983308 to 19668035460670230 after a single yield.

If the task later issues sched_yield(), yield_task_fair() assigns se->vruntime = se->deadline. The inflated vruntime, when multiplied by entity weight, overflows the key used by EEVDF and corrupts cfs_rq->sum_w_vruntime. All entities on the runqueue can then appear ineligible, causing pick_next_entity() to return NULL and the kernel to crash on the next dereference.

Root Cause

The root cause is missing state initialization [CWE-665] in __sched_fork(). The rel_deadline field is meaningful only when se->deadline carries a valid relative deadline awaiting placement against vruntime. A freshly forked entity has no such inherited deadline, so retaining the flag causes place_entity() to misinterpret uninitialized scheduling state.

Attack Vector

The vulnerability is reachable from any local context that can fork a task and invoke sched_yield(). No special privileges are required. Exploitation produces a kernel crash and denial of service rather than memory corruption suitable for arbitrary code execution. The condition depends on scheduler state and is not network-reachable.

The upstream fix clears se->rel_deadline inside __sched_fork() alongside the other sched_entity runtime fields. See the kernel commits 3da56dc, 8f4a162, c71bf35, and f3c16e1 for the patch series.

Detection Methods for CVE-2026-52980

Indicators of Compromise

Unexpected kernel oops or panic referencing pick_next_entity, enqueue_entity, or place_entity in kernel/sched/fair.c
NULL pointer dereference stack traces immediately following a userland sched_yield() syscall
Anomalously large vruntime or deadline values reported via sched_debug or tracepoints

Detection Strategies

Monitor kern.log, dmesg, and journal output for kernel BUG or NULL dereference reports inside scheduler functions
Enable sched_switch and sched_stat_runtime tracepoints to capture entities with sudden vruntime jumps that double prior values
Compare running kernel version and patch level against the fixed commits listed in the kernel.org references

Monitoring Recommendations

Aggregate kernel crash telemetry from Linux endpoints and servers and alert on repeated scheduler-related faults
Track fork-heavy workloads that also invoke sched_yield(), such as user-space spinlocks or test harnesses
Audit installed kernel packages on a recurring schedule to confirm stable updates are applied

How to Mitigate CVE-2026-52980

Immediate Actions Required

Apply the kernel update that includes the __sched_fork() fix clearing se->rel_deadline on forked entities
Reboot affected hosts so the patched kernel image takes effect, since the bug resides in resident scheduler code
Inventory all Linux systems running EEVDF-enabled kernels and prioritize multi-tenant or shared-compute hosts

Patch Information

The fix is delivered through the upstream Linux kernel commits 3da56dc063cd, 8f4a16200785, c71bf35caba1, and f3c16e1f4a31. Consume the fix through your distribution's kernel package once it is rebased onto a stable tree that includes these commits.

Workarounds

No reliable runtime workaround exists because the defect is in core scheduler initialization; patching is the supported remediation
Restrict execution of untrusted local code on unpatched hosts to reduce the chance of crash-induced denial of service
Where feasible, limit workloads that combine high fork rates with sched_yield() until the kernel is updated

bash

# Verify the running kernel against the fixed commits
uname -r

# Debian/Ubuntu: apply the latest kernel and reboot
sudo apt-get update && sudo apt-get install --only-upgrade linux-image-$(uname -r | cut -d- -f3-)
sudo reboot

# RHEL/Fedora: update the kernel package and reboot
sudo dnf update kernel kernel-core kernel-modules
sudo reboot