CVE-2026-90432 Linux CVE debrief

Who should care

Defenders responsible for Linux kernel systems, particularly those using sched_ext, should assess exposure and prioritize patching affected versions. This includes operators managing Linux kernel deployments, platform administrators, vulnerability management teams, and security teams responsible for monitoring and mitigating potential exploitation attempts.

Why it matters

CVE-2026-90432 is a Linux kernel vulnerability that allows for a sched_ext abort directly from the hardlockup handler. Defenders should prioritize verifying and applying patches for Linux kernel versions affected by this vulnerability, particularly those versions identified as vulnerable in the source metadata.

• Verify Linux kernel versions for vulnerability
• Apply patches for affected versions
• Monitor system logs for potential exploitation attempts

Technical summary

The Linux kernel vulnerability CVE-2026-90432 allows for a sched_ext abort directly from the hardlockup handler. The sched_ext component previously deferred aborts to an irq_work due to exit claiming taking scx_sched_lock and not being able to run from NMI. However, this deferral is now unnecessary as claiming is NMI-safe and asserting ->aborting breaks live-locks that hard-lock CPUs. The self-detected case is now recoverable, and the return value has been fixed to only return %true when this call initiated the abort.

Defensive priority

Defenders should prioritize verifying and applying patches for Linux kernel versions affected by this vulnerability, particularly those versions identified as vulnerable in the source metadata.

Recommended defensive actions

• Verify Linux kernel versions for vulnerability
• Apply patches for affected versions
• Monitor system logs for potential exploitation attempts
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and source item provide details on the vulnerability, including affected Linux kernel versions and references to source code changes. Defenders should verify Linux kernel versions for vulnerability, review official advisories for affected scope and severity, and apply patches for affected versions. The self-detected case is now recoverable, and the return value has been fixed to only return %true when this call initiated the abort. Evidence limits suggest focusing on sched_ext component deferrals to irq_work and NMI-saf

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.