CVE-2026-98418

Received Received - Intake

False Migration Warning in Linux Kernel Scheduler

Publication date: 2026-10-14

Last updated on: 2026-10-19

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: sched/core: Avoid false migration warning for proxy donors Proxy execution can move a blocked donor's scheduling context to the lock owner's CPU even when the donor is migration-disabled. The donor does not execute there, and its original execution CPU remains recorded in wake_cpu. set_task_cpu() warns unconditionally for migration-disabled tasks, so a subsequent proxy migration or the wakeup path returning the donor home triggers a false positive: moving a blocked scheduling context does not violate the migration-disabled execution context. For example, creating a mutex owner on CPU1 and a migration-disabled waiter on CPU0 can trigger the following warning: proxy_migrate_repro: donor blocking on CPU0 with migration disabled proxy_migrate_repro: donor moved from CPU0 to CPU1 WARNING: kernel/sched/core.c:3389 at set_task_cpu+0x1d3/0x280 ... Call Trace: try_to_wake_up+0x43f/0x780 __mutex_unlock_slowpath+0x330/0x540 owner_fn+0x9f/0xc0 [proxy_migrate_repro] ... proxy_migrate_repro: donor woke on CPU0, task_cpu=0 proxy_migrate_repro: completed Exclude blocked proxy donors from the warning. The proxy wakeup path restores an executable placement before clearing the blocked state.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-14

Last Modified

2026-10-19

Generated

2026-10-19

AI Q&A

2026-10-15

EPSS Evaluated

2026-10-18

NVD

CVE-2026-98418

EUVD

EUVD-2026-101067

Affected Vendors & Products

Vendor	Product	Version / Range
Linux	Linux	b049b81bdff6fc6794200a4c7d7d910e2008d57f
Linux	Linux	b049b81bdff6fc6794200a4c7d7d910e2008d57f
Linux	Linux	7.1

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability involves a false positive warning in the Linux kernel's scheduler. When a blocked task (donor) is moved to another CPU due to proxy execution, the kernel incorrectly warns about violating migration-disabled execution contexts. The issue occurs because set_task_cpu() always warns for migration-disabled tasks, even when the move is valid for blocked tasks.

Detection Guidance

This vulnerability is specific to the Linux kernel's scheduler and does not have a direct network detection method. Detection involves checking kernel logs for the false migration warning described in the CVE. Monitor system logs for warnings from set_task_cpu() in sched/core.c, particularly around proxy migration events.

Impact Analysis

This vulnerability primarily affects system stability by generating false positive warnings in kernel logs. It does not directly compromise security or data integrity but may cause confusion during debugging and system monitoring. The impact is limited to kernel log noise and potential misinterpretation of scheduler behavior.

Compliance Impact

This vulnerability does not directly affect compliance with standards like GDPR or HIPAA as it pertains to a false warning in the Linux kernel's scheduler. It does not involve data exposure, unauthorized access, or privacy violations that these regulations address.

Mitigation Strategies

Apply the latest Linux kernel patches that address this issue. Since this is a kernel-level bug, updating to a patched kernel version is the primary mitigation. Check your distribution's security advisories for kernel updates addressing CVE-2026-98418.

Hi! I’m here to help you understand CVE-2026-98418. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70