CVE-2026-64374: Linux Kernel Race Condition Vulnerability

CVE-2026-64374 Overview

CVE-2026-64374 is a Linux kernel vulnerability in the real-time (RT) scheduler subsystem. The flaw resides in the RT_PUSH_IPI logic used to migrate high-priority RT tasks between CPUs. On non PREEMPT_RT kernels, softirqs execute in interrupt context rather than a threaded context. This behavioral difference allows a live lock condition when softirq-heavy workloads coincide with queued RT tasks. Affected CPUs receive continuous inter-processor interrupts (IPIs) requesting a reschedule, but the executing softirq prevents the schedule from completing. The result is a denial-of-service condition on multi-CPU systems performing heavy networking or similar softirq-intensive work.

Critical Impact
A CPU can become live locked under heavy softirq load with queued RT tasks, causing a system-level denial of service on non-PREEMPT_RT kernels.

Affected Products

Linux kernel builds compiled without CONFIG_PREEMPT_RT
Distributions shipping mainline Linux kernels with the RT_PUSH_IPI scheduler feature enabled by default
Multi-CPU systems running RT workloads alongside network-intensive softirq processing

Discovery Timeline

2026-07-25 - CVE-2026-64374 published to NVD
2026-07-27 - Last updated in NVD database

Technical Details for CVE-2026-64374

Vulnerability Analysis

The Linux RT scheduler aggressively migrates high-priority tasks. When a CPU schedules a lower-priority task, it inspects the RT overloaded mask (rto) to locate CPUs holding waiting RT tasks of higher priority. Historically, the pulling CPU grabbed the remote runqueue lock directly, which caused lock contention and latency spikes up to 500us on large systems. The RT_PUSH_IPI mechanism was introduced to eliminate that contention by sending an IPI to the overloaded CPU and asking it to push the task locally.

On non PREEMPT_RT kernels, softirqs run in hard interrupt context. When an IPI arrives at a CPU running a softirq with RT tasks queued, the handler requests a reschedule that cannot proceed until the softirq completes. Peer CPUs continue observing the CPU as overloaded and keep sending IPIs. Each IPI extends softirq processing further, preventing task context from ever running.

Root Cause

The root cause is a design assumption that IPI-driven push scheduling would complete promptly. This assumption holds when softirqs run in threaded context under PREEMPT_RT, but fails on standard kernels where softirqs execute in interrupt context. Repeated IPIs starve the CPU of task-context execution time, producing a live lock.

Attack Vector

The vulnerability is triggered by workload characteristics rather than crafted input. A reproducer requires a large multi-CPU host running heavy networking traffic that generates sustained softirq activity while RT tasks are being woken. In the reported case, softirqs consumed 500us of every 750us window. Any unprivileged local workload capable of generating similar softirq pressure combined with RT wakeups can induce the condition on affected kernels.

See the upstream fix commits, including commit 44aae426dbfd and commit dd29c017aed6, for the code-level change that disables RT_PUSH_IPI by default when PREEMPT_RT is not enabled.

Detection Methods for CVE-2026-64374

Indicators of Compromise

Sustained high softirq CPU utilization visible in /proc/softirqs or mpstat output on one or more cores
Elevated rescheduling IPI counts in /proc/interrupts (RES counter) correlated with RT workload activity
RT task starvation reflected in scheduler latency tracing, with runnable tasks not progressing on overloaded CPUs

Detection Strategies

Enable kernel scheduler tracepoints (sched:sched_switch, sched:sched_wakeup) and correlate against softirq entry and exit events to identify starvation
Monitor RT_PUSH_IPI behavior using ftrace on the push_rt_tasks and tell_cpu_to_push functions
Alert on hosts where softirq time exceeds 60 percent of a CPU while RT tasks remain runnable but not scheduled

Monitoring Recommendations

Ingest host telemetry (/proc/interrupts, /proc/softirqs, scheduler tracepoints) into a centralized analytics platform for anomaly detection
Track kernel version and CONFIG_PREEMPT_RT status across the fleet to prioritize systems still exposed
Watch for symptoms of unresponsive nodes running RT workloads on high-traffic network hosts

How to Mitigate CVE-2026-64374

Immediate Actions Required

Inventory Linux hosts running non PREEMPT_RT kernels that also execute RT-scheduled workloads or heavy network traffic
Apply the upstream kernel patches that make RT_PUSH_IPI default off when PREEMPT_RT is not enabled
Where patching is delayed, disable the RT_PUSH_IPI scheduler feature at runtime to remove the live-lock trigger

Patch Information

The fix is delivered across multiple stable branches. Relevant commits include 44aae426dbfd, 4bd0da48fbc1, 860aaff72c84, 89237c8fc15d, a18f80bf5359, b99f04ae3d20, d8312a56d9a1, and dd29c017aed6. Update to a distribution kernel that includes these commits.

Workarounds

Disable RT_PUSH_IPI at runtime through the scheduler debug interface until a patched kernel is deployed
Segregate RT workloads from softirq-heavy network processing using CPU pinning and IRQ affinity
Reduce softirq pressure by tuning network interrupt coalescing and using receive packet steering to distribute load

bash

# Runtime workaround: disable RT_PUSH_IPI on non-PREEMPT_RT kernels
# Requires CONFIG_SCHED_DEBUG=y
cat /sys/kernel/debug/sched/features
echo NO_RT_PUSH_IPI | sudo tee /sys/kernel/debug/sched/features

# Verify the feature is disabled
grep -o 'NO_RT_PUSH_IPI' /sys/kernel/debug/sched/features