PT-2026-38974 · Linux · Linux Kernel

John · Published 2026-05-08 · Updated 2026-05-16 · CVE-2026-43323

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description An issue exists in the fair scheduler (sched/fair) regarding the tracking of zero vruntime. When two runnable tasks repeatedly perform a yield operation, they can enter a state where they leapfrog each other. Because zero vruntime is only updated during ticks or full enqueue/dequeue operations, and not during enqueue entity() or dequeue entity() calls from put prev task() or set next task(), the tracking can fall behind. If these tasks reach an overflow point within a single tick's duration, it can lead to system instability. This risk is further increased when multiple cgroups (control groups, a Linux kernel feature that limits, accounts for, and isolates the resource usage of a collection of processes) are involved, as there is no guarantee that every cgroup will receive a tick in a timely manner.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Related Identifiers

CVE-2026-43323

Affected Products

Linux Kernel

References · 15

• https://security-tracker.debian.org/tracker/CVE-2026-43323 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-43323 · Vendor Advisory
• https://git.kernel.org/stable/c/fb61ffb3fb30a161eb5404c27fc7635e275beafd · Patch
• https://git.kernel.org/stable/c/1319ea57529e131822bab56bf417c8edc2db9ae8 · Patch
• https://cve.org/CVERecord?id=CVE-2026-43323 · Security Note
• https://osv.dev/vulnerability/BELL-CVE-2026-43323 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-43323 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-43323 · Security Note
• https://git.kernel.org/stable/c/87573883c30f1a8555ff720836bb6ea231058539 · Patch
• https://git.kernel.org/stable/c/c089147074ed96ff4330739a0559394c19a3dfc8 · Patch
• https://ubuntu.com/security/CVE-2026-43323 · Vendor Advisory
• https://twitter.com/infoflowcloud/status/2052812492913492388 · Twitter Post
• https://docs.bell-sw.com/security/cves/CVE-2026-43323 · Note
• https://git.kernel.org/linus/1319ea57529e131822bab56bf417c8edc2db9ae8 · Note
• https://twitter.com/CVEnew/status/2052811059069653029 · Twitter Post