What is the CVSS score of CVE-2026-23371?

CVE-2026-23371 has a CVSS 3.1 base score of 5.5 (Medium). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.0%.

Is there a patch available for CVE-2026-23371?

Yes, a patch is available for CVE-2026-23371. Update the affected software to the latest version immediately.

Linux CVE-2026-23371

EUVD-2026-15357 MEDIUM

2026-03-25 Linux

GHSA-55fv-ccjv-2hr3

Information Disclosure Linux

5.5

CVSS 3.1 · NVD

View

Vulnerability Assessment

Impact

Risk assessment is constrained by incomplete vulnerability metadata: no CVSS score, vector, EPSS probability score, or KEV status is available. However, contextual analysis reveals moderate real-world risk. The attack vector is local (unprivileged user execution via stress-ng or similar workload), attack complexity is medium (requires specific timing and workload conditions involving PI mutexes and sched_setscheduler calls), and privileges required are none (unprivileged user can trigger via stress testing). The technical impact is denial of service (kernel warnings, system instability, potential soft lockups or task scheduling failures) rather than privilege escalation or data exfiltration. The vulnerability is reproducible on large multi-core systems under load. Availability of fixes in stable kernel branches (commits ba1c22924ddcc280672a2a06a9ca99ee3a1b92c3 and d658686a1331db3bb108ca079d76deb3208ed949) indicates the kernel maintainers treated this seriously, but the lack of CVSS/EPSS metrics and KEV listing suggests this is not a critical zero-day. This is a real but lower-priority defect suitable for standard patching cycles rather than emergency updates.

Exploit ScenarioDerived

An unprivileged local user on a large multi-core real-time Linux system (e.g., industrial automation, edge computing, or high-performance computing platform) executes stress-ng with SCHED_DEADLINE scheduling policies while triggering priority-inheritance mutex contentions. The scheduler's failure to properly set the ENQUEUE_REPLENISH flag during task demotion causes running_bw underflow, triggering kernel WARNINGS and potentially leading to scheduler instability, missed deadline guarantees, and denial of service for other real-time tasks sharing the system. The attack has low barrier to entry (unprivileged execution), medium reliability (depends on system size and timing), and low sophistication required, making it a realistic risk for shared real-time systems but not a vector for privilege escalation or remote compromise.

This Month Plan within 30 days. Why: MEDIUM severity (CVSS 4.0-6.9).

Patch available 0.0% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Mar 25, 2026

A Linux kernel scheduler vulnerability in SCHED_DEADLINE task handling causes bandwidth accounting corruption when a deadline task holding a priority-inheritance mutex is changed to a lower priority class via sched_setscheduler(). The vulnerability affects Linux kernel implementations (all versions with SCHED_DEADLINE support) and can be triggered by local unprivileged users running specific workloads like stress-ng, potentially leading to kernel warnings, task accounting underflow, and denial of service. No active exploitation in the wild is currently documented, but the vulnerability is fixed in stable kernel branches as evidenced by the provided commit references.

RemediationAI

Apply the Linux kernel patch by updating to a stable kernel version that includes commits ba1c22924ddcc280672a2a06a9ca99ee3a1b92c3 (the primary fix introducing __setscheduler_dl_pi() function) or later. Users should upgrade their kernel using standard distribution mechanisms (apt/yum/dnf for Debian/Red Hat-based systems, or by rebuilding from the Linux kernel source repository at https://git.kernel.org/stable/). For systems unable to upgrade immediately, restrict execution of stress-testing utilities and scheduler manipulation tools (stress-ng, custom sched_setscheduler callers) to trusted administrative users only, and avoid running mixed-priority real-time workloads on high-core-count systems until patched. The vulnerability is addressed directly by the fix and does not have meaningful workarounds, making prompt patching the primary mitigation.

Affected VersionsENISA

Linux 2279f540ea7d05f22d2f0c4224319330228586bc <d658686a1331db3bb108ca079d76deb3208ed949

Linux 5.10

Linux 3cc3d77dc541181f97f1dc96d2977ef8359fd760

Linux patch: 0

Linux patch: 6.19.7

Linux d2b65976bf1ae9d0d9dd5770cd01695559438309

Linux 2279f540ea7d05f22d2f0c4224319330228586bc <ba1c22924ddcc280672a2a06a9ca99ee3a1b92c3

Linux patch: 7.0-rc3

Affected Packages

euvd linux no fix

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Technical ContextAI · show details

This vulnerability exists in the Linux kernel's deadline scheduler (kernel/sched/deadline.c), which manages SCHED_DEADLINE tasks—a real-time scheduling class introduced in Linux 3.14 for tasks with hard temporal deadlines. The affected products are identified by CPE cpe:2.3:a:linux:linux:*:*:*:*:*:*:*:* (all Linux kernel versions). The root cause involves improper handling of bandwidth accounting when a DEADLINE task (lock holder in a priority-inheritance mutex scenario) is demoted to a lower scheduling class without properly inheriting deadline parameters from the blocking DEADLINE donor task. The bug manifests in the task enqueue logic, where the ENQUEUE_REPLENISH flag should be set during the scheduler class transition to maintain running bandwidth (running_bw) consistency, but is omitted when the holder did not previously inherit the donor's parameters. This is fundamentally a state management and flag-synchronization defect in real-time scheduler operations.

Know when the next one hits your stack

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

NVD PRIMARY 5.5 MEDIUM

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

SUSE 5.2 MEDIUM

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

CVSS changed

Apr 24, 2026 - 16:37 NVD

5.5 (MEDIUM)

Patch released

Mar 31, 2026 - 21:13 nvd

Patch available

CVE Published

Mar 25, 2026 - 10:27 nvd

N/A

DescriptionNVD

In the Linux kernel, the following vulnerability has been resolved:

sched/deadline: Fix missing ENQUEUE_REPLENISH during PI de-boosting

Running stress-ng --schedpolicy 0 on an RT kernel on a big machine might lead to the following WARNINGs (edited).

sched: DL de-boosted task PID 22725: REPLENISH flag missing

WARNING: CPU: 93 PID: 0 at kernel/sched/deadline.c:239 dequeue_task_dl+0x15c/0x1f8 ... (running_bw underflow) Call trace: dequeue_task_dl+0x15c/0x1f8 (P) dequeue_task+0x80/0x168 deactivate_task+0x24/0x50 push_dl_task+0x264/0x2e0 dl_task_timer+0x1b0/0x228 __hrtimer_run_queues+0x188/0x378 hrtimer_interrupt+0xfc/0x260 ...

The problem is that when a SCHED_DEADLINE task (lock holder) is changed to a lower priority class via sched_setscheduler(), it may fail to properly inherit the parameters of potential DEADLINE donors if it didn't already inherit them in the past (shorter deadline than donor's at that time). This might lead to bandwidth accounting corruption, as enqueue_task_dl() won't recognize the lock holder as boosted.

The scenario occurs when:

A DEADLINE task (donor) blocks on a PI mutex held by another

DEADLINE task (holder), but the holder doesn't inherit parameters (e.g., it already has a shorter deadline)

sched_setscheduler() changes the holder from DEADLINE to a lower

class while still holding the mutex

The holder should now inherit DEADLINE parameters from the donor

and be enqueued with ENQUEUE_REPLENISH, but this doesn't happen

Fix the issue by introducing __setscheduler_dl_pi(), which detects when a DEADLINE (proper or boosted) task gets setscheduled to a lower priority class. In case, the function makes the task inherit DEADLINE parameters of the donoer (pi_se) and sets ENQUEUE_REPLENISH flag to ensure proper bandwidth accounting during the next enqueue operation.

Threat Intelligence Overview

EPSS Score

0.0%

Top 95% exploitable

Data Quality

6 sources

Confidence: High

EUVD

NVD

CVE.org

EPSS MSRC Vendor

VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity MEDIUM

CISA KEV No

Public POC No

EPSS 0.0%

Patch available Yes

Active threat No

Deciding rule

MEDIUM severity (CVSS 4.0-6.9)

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived

Defer

Exploitation· derived

None

System Exposure· derived

Small

Automatable· derived

Human Impact· derived

Medium

Priority Score

Low Medium High Critical

KEV: 0

EPSS: 0

CVSS: +28

PoC: 0

Weaponized: 0

Threat intel: 0

Gov advisory: 0

Attack Technique

Information Disclosure MEDIUM

Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.

Related Vulnerabilities in Linux Kernel Multiple Vulnerabilities

View all 4

CVE-2026-23372 HIGH

7.8

CVE-2026-23346 MEDIUM

5.5

CVE-2026-23316 MEDIUM

5.5

Same technique Information Disclosure

View all

CVE-2019-2725 CRITICAL POC

9.8

CVE-2021-34523 CRITICAL POC

9.0

CVE-2013-2251 CRITICAL POC

9.8

CVE-2017-5638 CRITICAL POC

9.8

CVE-2025-24813 CRITICAL POC

9.8

CVE-2025-68613 HIGH POC

8.8

CVE-2015-1701 HIGH POC

7.8

CVE-2017-0147 HIGH POC

7.5

Vendor StatusVendor

Debian

linux

Release	Status	Fixed Version	Urgency
bullseye	vulnerable	5.10.223-1	-
bullseye (security)	vulnerable	5.10.251-1	-
bookworm	vulnerable	6.1.159-1	-
bookworm (security)	vulnerable	6.1.164-1	-
trixie	vulnerable	6.12.73-1	-
trixie (security)	vulnerable	6.12.74-2	-
forky, sid	fixed	6.19.8-1	-
(unstable)	fixed	6.19.8-1	-

SUSE

Severity: Medium

Product	Status
SUSE Linux Enterprise Desktop 15 SP7	Fixed
SUSE Linux Enterprise Desktop 15 SP7	Fixed
SUSE Linux Enterprise High Availability Extension 15 SP7	Fixed
SUSE Linux Enterprise High Availability Extension 15 SP7	Fixed
SUSE Linux Enterprise High Performance Computing 15 SP7	Fixed

References

Advisories & patches

ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2026-23371 ADVISORY https://vuldb.com/?id.353053 REF https://git.kernel.org/stable/c/0638bf16b7a73a2fe63624bd0d16d9fd904805c3 REF https://git.kernel.org/stable/c/65af3633caf195d397ec4c39f51ae7615bd5a627 REF https://git.kernel.org/stable/c/ba1c22924ddcc280672a2a06a9ca99ee3a1b92c3 REF https://git.kernel.org/stable/c/ce6253fe718811cceb3a0ae0dbf0a5941dea3eb6 REF https://git.kernel.org/stable/c/d658686a1331db3bb108ca079d76deb3208ed949 REF https://git.kernel.org/stable/c/e0e20852d44261a9d69188bc483872930e7ba727

Search Externally

GitHub PoC

Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC

Back