CVE-2026-93182 in Linux
Summary
by MITRE • 09/18/2026
In the Linux kernel, the following vulnerability has been resolved:
sched/fair: Fix overflow in update_tg_cfs_runnable()
A divide-by-zero crash is observed when running hackbench:
[14697.488452] CPU: 112 UID: 0 PID: 124791 Comm: hackbench Not tainted 7.1.0-rc2+
[14697.492627] RIP: 0010:propagate_entity_load_avg+0x35f/0x3e0
[14697.506799] <TASK>
[14697.507411] __dequeue_task+0x2b4/0xc70
[14697.508677] dequeue_task_fair+0x36/0x370
[14697.509047] dequeue_task+0x101/0x2f0
[14697.509426] __schedule+0x1b1/0x1a00
[14697.510868] anon_pipe_read+0x3da/0x450
[14697.511400] vfs_read+0x361/0x390
[14697.512053] __x64_sys_read+0x19/0x30
The divide-by-zero happens here:
if (scale_load_down(gcfs_rq->load.weight)) {
load_sum = div_u64(gcfs_rq->avg.load_sum, scale_load_down(gcfs_rq->load.weight)); }
gcfs_rq->load.weight is an insane large value and is truncated to the lower 32 bits by div_u64, which happen to be 0.
Using AI for investigation, the cause is a u32 overflow in update_tg_cfs_runnable(), and flat pickup became a victim when using tg_tasks():
u32 new_sum, divider; ... new_sum = se->avg.runnable_avg * divider; <-- boom
The following sequence shows how this triggers the crash:
propagate_entity_load_avg() update_tg_cfs_runnable() # u32 overflow corrupts runnable_sum
__update_load_avg_cfs_rq() ___update_load_avg() # computes insane runnable_avg update_tg_load_avg() # propagates to tg->runnable_avg
update_cfs_group() calc_concur_shares() tg_tasks() # long-to-int truncation, negative nr reweight_entity() # corrupted se->load.weight update_load_add() # corrupted cfs_rq->load.weight
propagate_entity_load_avg() update_tg_cfs_load() div_u64() # divide-by-zero
Fix by widening new_sum from u32 to u64 (no need to force tg_tasks() to return unsigned long after this fix)
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 09/18/2026
The Linux kernel scheduler contains a critical integer overflow vulnerability within the update_tg_cfs_runnable function that can lead to system instability and denial of service. This flaw manifests as a divide-by-zero crash, specifically observed during execution of workloads such as hackbench which stress the scheduling subsystem. The root cause lies in the use of an unsigned 32-bit integer variable named new_sum for accumulating runnable average metrics. When this value exceeds the maximum limit of a u32 type, it wraps around to zero or near-zero values due to arithmetic overflow. This corrupted numerical state propagates through various scheduler data structures, ultimately resulting in invalid load weights that trigger fatal division errors when the kernel attempts to normalize these values for task scheduling decisions.
The technical mechanism involves several interconnected components of the Completely Fair Scheduler (CFS). The vulnerability originates when calculating new_sum by multiplying se->avg.runnable_avg with a divider value. Because this operation is performed using u32 arithmetic, large accumulated runnable averages cause an overflow condition. This corrupted sum then influences tg_tasks() which may return truncated or negative values due to long-to-int truncation issues in related code paths. These incorrect task counts feed into reweight_entity and update_load_add functions, causing cfs_rq->load.weight to become an insane large value that gets truncated to zero when processed by div_u64. The subsequent call to propagate_entity_load_avg attempts to divide load_sum by this now-zero weight parameter, resulting in a kernel panic with the RIP pointing directly at the division instruction within propagate_entity_load_avg.
From a security perspective, this vulnerability represents an integer overflow leading to denial of service conditions classified under CWE-190 Integer Overflow or Wraparound and CWE-369 Divide By Zero. The attack vector is local and requires execution context that can trigger high runnable average calculations in the scheduler subsystem. While not directly exploitable for privilege escalation due to its nature as a crash condition, it effectively allows any user with sufficient CPU scheduling influence to destabilize the system by inducing resource exhaustion patterns that trigger this specific code path. The vulnerability aligns with ATT&CK technique T1499 Endpoint Denial of Service where an adversary might leverage software flaws to disrupt service availability rather than compromising confidentiality or integrity directly.
The operational impact includes complete system unresponsiveness due to kernel panics requiring hard resets, potential data corruption if the crash occurs during critical I/O operations, and reduced reliability for production workloads that rely on consistent scheduling behavior. Systems running kernels prior to this fix are susceptible when subjected to specific workload patterns involving high task concurrency or unusual runnable average accumulations. The vulnerability affects multiple kernel versions including 7.1.0-rc2 and likely earlier releases sharing the same scheduler implementation logic, making it a significant concern for enterprise environments where system uptime is critical.
Mitigation strategies primarily involve applying the upstream Linux kernel patch that widens new_sum from u32 to u64 type width preventing overflow conditions during arithmetic operations. Administrators should ensure their systems are updated with patched kernel versions containing this fix. In environments where immediate patching is not feasible, monitoring for high CPU usage patterns and unusual scheduling behaviors can help detect potential exploitation attempts before they trigger crashes. Additionally, implementing resource limits through cgroups to restrict excessive runnable average accumulation in specific workloads may reduce the likelihood of triggering the overflow condition until permanent fixes are deployed across all affected systems.