CVE-2026-99250 in Linux
Summary
by MITRE • 11/03/2026
In the Linux kernel, the following vulnerability has been resolved:
printk: Postpone kthread startup
There have been various bug reports related to SMP systems hanging on boot. The reports vary but seem to have some overlap with regard to missed IPI's during SMP setup. The reports also show that reverting NBCON console usage allows the bugs to disappear.
The NBCON kthreads for console printing are started very early during boot using early_initcall(). Since these kthreads are asynchronously enabling/disabling interrupts during early boot, they may be interfering with early SMP setup on some hardware platforms.
Starting the console printing kthreads later has shown to avoid the hanging on systems that could previously reproduce the issue.
Postpone kthread starting until after all arch initcalls have completed.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 11/03/2026
The Linux kernel vulnerability addressed involves a race condition and timing conflict during the early boot sequence of Symmetric Multiprocessing (SMP) enabled systems, specifically related to the initialization order of console printing threads versus CPU hotplug and SMP setup mechanisms. The root cause lies in the use of NBCON, or NMI-safe Console Output, which is designed to allow kernel logging even when interrupts are disabled or during Non-Maskable Interrupts. To achieve this safety guarantee, the system spawns dedicated kthreads for handling console output very early in the boot process via early_initcall hooks. These threads operate by asynchronously enabling and disabling local CPU interrupts to safely write log messages without causing deadlocks or data corruption on systems where interrupt state is critical.
However, this aggressive asynchronous interrupt manipulation conflicts with the delicate synchronization required during SMP initialization. During SMP setup, the kernel must carefully coordinate between boot CPUs and secondary processors, often relying on Inter-Processor Interrupts (IPIs) to synchronize memory barriers, cache coherency operations, and CPU online states. The NBCON kthreads, by frequently toggling interrupt states while these synchronization primitives are being established, can inadvertently mask or drop critical IPI signals. This interference leads to missed interrupts that prevent secondary CPUs from properly joining the SMP cluster, resulting in system hangs where the boot process stalls indefinitely because not all processors have come online as expected.
From a vulnerability classification perspective, this issue aligns with CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization, specifically manifesting as a race condition during system initialization. In terms of MITRE ATT&CK mapping for Linux systems, while this is not an exploitable attack vector in the traditional sense, it relates to T1059.004: Unix Shell Commands and underlying OS mechanisms where improper configuration or timing can lead to denial of service through system instability. The flaw represents a design-level concurrency issue rather than a memory corruption vulnerability, but its impact is severe as it causes complete boot failures on affected hardware platforms, effectively rendering the systems unusable until patched.
The operational impact of this vulnerability is primarily a Denial of Service (DoS) condition occurring at the earliest stage of system availability. Affected SMP-based Linux distributions experience hard hangs during the boot sequence, preventing the operating system from reaching multi-user mode or any functional state where services can be started. This impacts both physical servers and virtualized environments that emulate SMP configurations. The inconsistency in reproduction across different hardware platforms suggests that the issue is highly dependent on specific timing windows inherent to particular CPU architectures or motherboard chipsets, making it difficult for end-users to diagnose without deep kernel debugging capabilities.
The resolution involves deferring the startup of the NBCON console printing kthreads until after all architecture-specific initialization calls have completed. By postponing these threads, the system ensures that SMP setup and IPI synchronization are fully stabilized before any asynchronous interrupt manipulation begins. This change preserves the NMI-safe logging capability for later stages of boot and runtime operation while eliminating the conflict during the critical early-boot window. Administrators should ensure their systems are updated with kernel versions containing this fix to restore stability on affected hardware configurations, particularly those that previously exhibited SMP hangs due to missed IPIs during initialization.