---
id: CVE-2026-90432
title: |-
  In the Linux kernel, the following vulnerability has been resolved:

  sched_ext: Abort directly from the hardlockup handler

  scx_hardlockup() defers the abort to an irq_work because exit claiming used
  to take scx_sched_lock and couldn't r…
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  sched_ext: Abort directly from the hardlockup handler

  scx_hardlockup() defers the abort to an irq_work because exit claiming used
  to take scx_sched_lock and couldn't r…
severity: medium
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= bd2d76455b65aab77652823919db128a8e585825 <
    4d6270bbb4e083a4d2d39f3c36f30f5c939c06ed
  - >-
    Linux >= bd2d76455b65aab77652823919db128a8e585825 <
    3c4b38064937a761ebbf85b1649e812db85eb59e
  - Linux 7.1
published: '2026-09-17'
updated: '2026-09-17'
sourceUpdated: '2026-09-17T17:17:48.263'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-90432'
references:
  - url: 'https://git.kernel.org/stable/c/3c4b38064937a761ebbf85b1649e812db85eb59e'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/4d6270bbb4e083a4d2d39f3c36f30f5c939c06ed'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: >-
      https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-90432.json
  - url: 'https://access.redhat.com/security/cve/CVE-2026-90432'
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2536354'
  - url: 'https://www.cve.org/CVERecord?id=CVE-2026-90432'
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-90432'
  - url: >-
      https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-90432.mbox
tags:
  - nvd
  - cve.org
  - csaf
  - vex
  - red-hat
ingestedAt: '2026-09-17T16:21:47.791Z'
epss: 0.00198
epssPercentile: 0.09428
cvss: 5.5
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'
cvssSource: vendor
cwe:
  - CWE-253
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

sched_ext: Abort directly from the hardlockup handler

scx_hardlockup() defers the abort to an irq_work because exit claiming used
to take scx_sched_lock and couldn't run from NMI. The deferral is now
unnecessary - claiming is NMI-safe and asserting ->aborting is exactly what
breaks the live-locks that hard-lock CPUs. Call handle_lockup() directly and
drop the irq_work. This also makes the self-detected case recoverable: the
perf watchdog fires on the hard-locked CPU itself, where a queued irq_work
never runs with IRQs off.

Also fix the return value: %true used to be returned whenever sched_ext was
loaded, suppressing the kernel's hardlockup report even when the abort was
refused. Return %true only when this call initiated the abort.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

## Vendor advisories

- **Red Hat VEX** · Moderate · updated 2026-10-20 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-90432.json)