PT-2026-27736 · Linux · Linux Kernel

Published 2026-01-01 · Updated 2026-04-20 · CVE-2026-23371

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description A flaw exists in the Linux kernel’s scheduling logic related to SCHED DEADLINE tasks. Specifically, when a SCHED DEADLINE task changes to a lower priority class using sched setscheduler(), it may fail to correctly inherit parameters from potential DEADLINE donors if it hadn't already inherited them. This can lead to bandwidth accounting corruption because enqueue task dl() might not recognize the task as boosted. The issue occurs when a DEADLINE task blocks on a PI mutex held by another DEADLINE task, the holder doesn't initially inherit parameters, and the holder's priority is then lowered while still holding the mutex. The fix involves introducing the setscheduler dl pi() function to detect when a DEADLINE task is changed to a lower priority class, ensuring it inherits the necessary parameters and sets the ENQUEUE REPLENISH flag for proper bandwidth accounting.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Related Identifiers

CVE-2026-23371

OESA-2026-1862

OESA-2026-1863

OESA-2026-1864

Affected Products

Linux Kernel

References · 70

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/23xxx/CVE-2026-23371.json · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-23399 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-23171 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-23371 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-23393 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2025-68727 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-23304 · Security Note
• https://osv.dev/vulnerability/OESA-2026-1864 · Vendor Advisory
• https://git.kernel.org/stable/c/ba1c22924ddcc280672a2a06a9ca99ee3a1b92c3 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-23276 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-23293 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-23231 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-23381 · Security Note
• https://osv.dev/vulnerability/ROOT-OS-UBUNTU-2404-CVE-2026-23371 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-23096 · Security Note