CVE-2026-93150: cgroup/cpuset: Make nr_deadline_tasks an atomic_t

Severity: unknown
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-09-17 · updated 2026-10-30

Description

In the Linux kernel, the following vulnerability has been resolved: cgroup/cpuset: Make nr_deadline_tasks an atomic_t The nr_deadline_tasks variable in the cpuset structure was introduced by commit 6c24849f5515 ("sched/cpuset: Keep track of SCHED_DEADLINE task in cpusets"). It is reported by sashiko [1] that nr_deadline_tasks can currently be modified by inc_dl_tasks_cs() under rq->lock and by cpuset_attach() under cpuset_mutex. So if both updates happen simultaneously, the nr_deadline_tasks variable can be corrupted leading to incorrect operations down the road. Fix that by changing its type to atomic_t so that nr_deadline_tasks are always atomically updated. This fix patch is a low hanging fruit. It can handle some of the races between a concurrent sched_setscheduler() and cpuset_can_attach()/cpuset_attach() calls, but not all of them like the other issue raised by sashiko [2]. This will be handled hopefully in a future follow up patch. [1] https://sashiko.dev/#/patchset/20260626181923.133658-1-longman%40redhat.com [2] https://sashiko.dev/#/patchset/20260630033344.352702-1-longman%40redhat.com

Affected products

Linux: from 6.1.50 before 6.1.191; from 5.10.193 before 5.11; from 5.15.129 before 5.16; from 6.4.13 before 6.5 — fixed in 6.1.191, 5.11, 5.16, 6.5

How to fix

Upgrade to a fixed version: Linux 6.1.191, 5.11, 5.16, 6.5. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2026-93150 or the next vulnerability affects your stack