---
id: CVE-2026-90432
title: |-
  In the Linux kernel, the following vulnerability has been resolved:

  sched_ext: Abort directly from the hardlockup handler

  scx_hardlockup() defers the abort to an irq_work because exit claiming used
  to take scx_sched_lock and couldn't r…
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  sched_ext: Abort directly from the hardlockup handler

  scx_hardlockup() defers the abort to an irq_work because exit claiming used
  to take scx_sched_lock and couldn't r…
severity: none
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= bd2d76455b65aab77652823919db128a8e585825 <
    4d6270bbb4e083a4d2d39f3c36f30f5c939c06ed
  - >-
    Linux >= bd2d76455b65aab77652823919db128a8e585825 <
    3c4b38064937a761ebbf85b1649e812db85eb59e
  - Linux 7.1
published: '2026-09-17'
updated: '2026-09-17'
sourceUpdated: '2026-09-17T17:17:48.263'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-90432'
references:
  - url: 'https://git.kernel.org/stable/c/3c4b38064937a761ebbf85b1649e812db85eb59e'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/4d6270bbb4e083a4d2d39f3c36f30f5c939c06ed'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
tags:
  - nvd
  - cve.org
ingestedAt: '2026-09-17T16:21:47.791Z'
epss: 0.00198
epssPercentile: 0.08493
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

sched_ext: Abort directly from the hardlockup handler

scx_hardlockup() defers the abort to an irq_work because exit claiming used
to take scx_sched_lock and couldn't run from NMI. The deferral is now
unnecessary - claiming is NMI-safe and asserting ->aborting is exactly what
breaks the live-locks that hard-lock CPUs. Call handle_lockup() directly and
drop the irq_work. This also makes the self-detected case recoverable: the
perf watchdog fires on the hard-locked CPU itself, where a queued irq_work
never runs with IRQs off.

Also fix the return value: %true used to be returned whenever sched_ext was
loaded, suppressing the kernel's hardlockup report even when the abort was
refused. Return %true only when this call initiated the abort.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.