CVE-2026-90432

In the Linux kernel, the following vulnerability has been resolved: sched_ext: Abort directly from the hardlockup handler scx_hardlockup() defers the abort to an irq_work because exit claiming used to take scx_sched_lock and couldn't run from NMI. The deferral is now unnecessary - claiming is NMI-safe and asserting ->aborting is exactly what breaks the live-locks that hard-lock CPUs. Call handle_lockup() directly and drop the irq_work. This also makes the self-detected case recoverable: the perf watchdog fires on the hard-locked CPU itself, where a queued irq_work never runs with IRQs off. Also fix the return value: %true used to be returned whenever sched_ext was loaded, suppressing the kernel's hardlockup report even when the abort was refused. Return %true only when this call initiated the abort.

• https://git.kernel.org/stable/c/3c4b38064937a761ebbf85b1649e812db85eb59e
• https://git.kernel.org/stable/c/4d6270bbb4e083a4d2d39f3c36f30f5c939c06ed

Published

Sep 17, 2026

Last Modified

Sep 17, 2026

Status

Received

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-90426In the Linux kernel, the following vulnerability has been re…
• CVE-2026-90427In the Linux kernel, the following vulnerability has been re…7.4
• CVE-2026-90428In the Linux kernel, the following vulnerability has been re…
• CVE-2026-90429In the Linux kernel, the following vulnerability has been re…7.8
• CVE-2026-90430In the Linux kernel, the following vulnerability has been re…
• CVE-2026-90431In the Linux kernel, the following vulnerability has been re…
• CVE-2026-90433In the Linux kernel, the following vulnerability has been re…
• CVE-2026-90434In the Linux kernel, the following vulnerability has been re…
• CVE-2026-90435In the Linux kernel, the following vulnerability has been re…7.8
• CVE-2026-90439NGINX Plus and NGINX Open Source have a vulnerability in the…6.5
• CVE-2026-9044An OS command injection vulnerability exists in the VPN modu…8
• CVE-2026-90443A web interface reflects a portion of the request URL into a…5.3