Linux Kernel CVE-2026-43326

Requires local authenticated access with sufficient privileges to load BPF programs (typically CAP_BPF or CAP_SYS_ADMIN capabilities). The target system must be running Linux kernel 6.12 or later development versions (7.0-rc1 through rc7) compiled with CONFIG_SCHED_CLASS_EXT=y to enable the sched_ext extensible scheduler framework. The attacker must have the technical capability to write and load custom BPF scheduler programs that specifically invoke SCX_KICK_WAIT operations in patterns that create cyclic IPI dependencies between CPUs. Exploitation is limited to systems actively using the sched_ext feature - default kernel configurations with standard schedulers are not vulnerable even if sched_ext is compiled in but unused. The vulnerability cannot be triggered remotely or by unprivileged users lacking BPF program loading capabilities.

Real-world risk is LOW despite the high availability impact (CVSS A:H). The CVSS vector AV:L/AC:L/PR:L indicates local access with low privileges is required, limiting attack surface to users with shell access on affected systems. The EPSS score of 0.02% (5th percentile) indicates extremely low probability of exploitation in the wild. No CISA KEV listing confirms this is not being actively exploited. Attack complexity is technically high - triggering the deadlock requires deep knowledge of sched_ext internals and the ability to orchestrate specific IPI patterns across multiple CPUs, likely through custom BPF scheduler programs. The sched_ext feature itself is relatively new (introduced in kernel 6.12) and not enabled by default in most distributions, significantly reducing the exposed install base. The vulnerability affects only systems actively using custom BPF schedulers with SCX_KICK_WAIT operations. For organizations using standard kernel schedulers or not leveraging sched_ext features, risk is effectively zero. Priority should be medium for environments running bleeding-edge kernels with custom BPF schedulers, low for all others.

An authenticated local attacker with access to load BPF programs creates a custom scheduler that deliberately triggers SCX_KICK_WAIT operations on multiple CPUs in a coordinated pattern. By carefully timing IPI requests between CPU pairs, the attacker establishes a circular wait condition where CPU A waits for CPU B's kick_sync counter while CPU B simultaneously waits for CPU A. Both CPUs enter infinite busy-wait loops in hardirq context, unable to reschedule or process interrupts. The deadlock spreads as additional CPUs attempt to interact with the locked CPUs, eventually causing complete system unresponsiveness requiring hard reboot.