CVE-2026-98087 Linux CVE debrief

Who should care

Defenders responsible for Linux kernel deployments, especially those using real-time work, should assess exposure and prioritize verification and patching. This includes reviewing the presence of the vulnerability, assessing exposure in real-time work deployments, and applying patches or updates provided by the Linux kernel maintainers.

Why it matters

This vulnerability allows the RT balancer to waste CPU time in a retry loop, impacting real-time work deployments. Defenders should prioritize verification and patching.

• Verify the presence of this vulnerability in the Linux kernel
• Assess exposure in real-time work deployments
• Prioritize patching or updating the Linux kernel

Technical summary

The Linux kernel vulnerability CVE-2026-98087 allows the RT balancer to spend tens of milliseconds in a retry loop, consuming nearly half of the CPU time, when trying to push a migrate-disabled RT task. The issue arises from the scheduler keeping a migrate-disabled RT task on the CPU's pushable list, causing the RT balancer to continuously try to push the task, which fails. This results in wasted CPU time and impacts real-time work deployments. The vulnerability was resolved by addressing the RT balancer's behavior.

Defensive priority

Defenders should prioritize verifying the presence of this vulnerability in their Linux kernel and assessing exposure, especially in real-time work deployments.

Recommended defensive actions

• Verify the presence of this vulnerability in the Linux kernel
• Assess exposure, especially in real-time work deployments
• Review and apply patches or updates provided by the Linux kernel maintainers
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed

Evidence notes

The vulnerability was resolved in the Linux kernel by addressing the RT balancer's behavior. An ftrace capture shows the CPU time spent in the retry loop. The issue arises from the scheduler keeping a migrate-disabled RT task on the CPU's pushable list, causing the RT balancer to continuously try to push the task, which fails, and the CPU spends a significant amount of time in this retry loop. The self-IPI path is closed by the rto_next_cpu() fix, but the runqueue is still marked overloaded because the pinned task is still advertised.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.