Vulnerability-Lookup

FKIE_CVE-2026-43418

Vulnerability from fkie_nvd - Published: 2026-05-08 15:16 - Updated: 2026-05-12 14:10

Severity

Summary

In the Linux kernel, the following vulnerability has been resolved: sched/mmcid: Prevent CID stalls due to concurrent forks A newly forked task is accounted as MMCID user before the task is visible in the process' thread list and the global task list. This creates the following problem: CPU1 CPU2 fork() sched_mm_cid_fork(tnew1) tnew1->mm.mm_cid_users++; tnew1->mm_cid.cid = getcid() -> preemption fork() sched_mm_cid_fork(tnew2) tnew2->mm.mm_cid_users++; // Reaches the per CPU threshold mm_cid_fixup_tasks_to_cpus() for_each_other(current, p) .... As tnew1 is not visible yet, this fails to fix up the already allocated CID of tnew1. As a consequence a subsequent schedule in might fail to acquire a (transitional) CID and the machine stalls. Move the invocation of sched_mm_cid_fork() after the new task becomes visible in the thread and the task list to prevent this. This also makes it symmetrical vs. exit() where the task is removed as CID user before the task is removed from the thread and task lists.

References

	URL	Tags
	416baaa9-dc9f-4396-8d5f-8c081fb06d67	https://git.kernel.org/stable/c/b2e48c429ec54715d16fefa719dd2fbded2e65be
	416baaa9-dc9f-4396-8d5f-8c081fb06d67	https://git.kernel.org/stable/c/f0189d49282e0458f3a737bd486c1ec048148f66

Impacted products

	Vendor	Product	Version

JSON

To clipboard

{
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nsched/mmcid: Prevent CID stalls due to concurrent forks\n\nA newly forked task is accounted as MMCID user before the task is visible\nin the process\u0027 thread list and the global task list. This creates the\nfollowing problem:\n\n CPU1\t\t\tCPU2\n fork()\n   sched_mm_cid_fork(tnew1)\n     tnew1-\u003emm.mm_cid_users++;\n     tnew1-\u003emm_cid.cid = getcid()\n-\u003e preemption\n\t\t\tfork()\n\t\t\t  sched_mm_cid_fork(tnew2)\n\t\t\t    tnew2-\u003emm.mm_cid_users++;\n                            // Reaches the per CPU threshold\n\t\t\t    mm_cid_fixup_tasks_to_cpus()\n\t\t\t    for_each_other(current, p)\n\t\t\t         ....\n\nAs tnew1 is not visible yet, this fails to fix up the already allocated CID\nof tnew1. As a consequence a subsequent schedule in might fail to acquire a\n(transitional) CID and the machine stalls.\n\nMove the invocation of sched_mm_cid_fork() after the new task becomes\nvisible in the thread and the task list to prevent this.\n\nThis also makes it symmetrical vs. exit() where the task is removed as CID\nuser before the task is removed from the thread and task lists."
    }
  ],
  "id": "CVE-2026-43418",
  "lastModified": "2026-05-12T14:10:27.343",
  "metrics": {},
  "published": "2026-05-08T15:16:53.803",
  "references": [
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/b2e48c429ec54715d16fefa719dd2fbded2e65be"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/f0189d49282e0458f3a737bd486c1ec048148f66"
    }
  ],
  "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
  "vulnStatus": "Undergoing Analysis"
}

CVE-2026-43418 (GCVE-0-2026-43418)

Vulnerability from cvelistv5 – Published: 2026-05-08 14:21 – Updated: 2026-05-11 22:24

Title

sched/mmcid: Prevent CID stalls due to concurrent forks

Summary

Severity

No CVSS data available.

Assigner

Linux

References

2 references

URL	Tags
https://git.kernel.org/stable/c/f0189d49282e0458f…
https://git.kernel.org/stable/c/b2e48c429ec54715d…

Impacted products

2 products

Vendor	Product	Version
Linux	Linux	Affected: fbd0e71dc370af73f6b316e4de9eed273dd90340 , < f0189d49282e0458f3a737bd486c1ec048148f66 (git) Affected: fbd0e71dc370af73f6b316e4de9eed273dd90340 , < b2e48c429ec54715d16fefa719dd2fbded2e65be (git)
Linux	Linux	Affected: 6.19 Unaffected: 0 , < 6.19 (semver) Unaffected: 6.19.9 , ≤ 6.19.* (semver) Unaffected: 7.0 , ≤ * (original_commit_for_fix)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "include/linux/sched.h",
            "kernel/fork.c",
            "kernel/sched/core.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "f0189d49282e0458f3a737bd486c1ec048148f66",
              "status": "affected",
              "version": "fbd0e71dc370af73f6b316e4de9eed273dd90340",
              "versionType": "git"
            },
            {
              "lessThan": "b2e48c429ec54715d16fefa719dd2fbded2e65be",
              "status": "affected",
              "version": "fbd0e71dc370af73f6b316e4de9eed273dd90340",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "include/linux/sched.h",
            "kernel/fork.c",
            "kernel/sched/core.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.19"
            },
            {
              "lessThan": "6.19",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.19.*",
              "status": "unaffected",
              "version": "6.19.9",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.0",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.19.9",
                  "versionStartIncluding": "6.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0",
                  "versionStartIncluding": "6.19",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nsched/mmcid: Prevent CID stalls due to concurrent forks\n\nA newly forked task is accounted as MMCID user before the task is visible\nin the process\u0027 thread list and the global task list. This creates the\nfollowing problem:\n\n CPU1\t\t\tCPU2\n fork()\n   sched_mm_cid_fork(tnew1)\n     tnew1-\u003emm.mm_cid_users++;\n     tnew1-\u003emm_cid.cid = getcid()\n-\u003e preemption\n\t\t\tfork()\n\t\t\t  sched_mm_cid_fork(tnew2)\n\t\t\t    tnew2-\u003emm.mm_cid_users++;\n                            // Reaches the per CPU threshold\n\t\t\t    mm_cid_fixup_tasks_to_cpus()\n\t\t\t    for_each_other(current, p)\n\t\t\t         ....\n\nAs tnew1 is not visible yet, this fails to fix up the already allocated CID\nof tnew1. As a consequence a subsequent schedule in might fail to acquire a\n(transitional) CID and the machine stalls.\n\nMove the invocation of sched_mm_cid_fork() after the new task becomes\nvisible in the thread and the task list to prevent this.\n\nThis also makes it symmetrical vs. exit() where the task is removed as CID\nuser before the task is removed from the thread and task lists."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-11T22:24:12.301Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/f0189d49282e0458f3a737bd486c1ec048148f66"
        },
        {
          "url": "https://git.kernel.org/stable/c/b2e48c429ec54715d16fefa719dd2fbded2e65be"
        }
      ],
      "title": "sched/mmcid: Prevent CID stalls due to concurrent forks",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-43418",
    "datePublished": "2026-05-08T14:21:54.362Z",
    "dateReserved": "2026-05-01T14:12:56.008Z",
    "dateUpdated": "2026-05-11T22:24:12.301Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

FKIE_CVE-2026-43418

CVE-2026-43418 (GCVE-0-2026-43418)

Tags

Sightings

Nomenclature