---
id: CVE-2026-93182
title: |-
  In the Linux kernel, the following vulnerability has been resolved:

  sched/fair: Fix overflow in update_tg_cfs_runnable()

  A divide-by-zero crash is observed when running hackbench:

     [14697.488452] CPU: 112 UID: 0 PID: 124791 Comm: ha…
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  sched/fair: Fix overflow in update_tg_cfs_runnable()

  A divide-by-zero crash is observed when running hackbench:

     [14697.488452] CPU: 112 UID: 0 PID: 124791 Comm: ha…
severity: none
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 95246d1ec80b8d19d882cd8eb7ad094e63b41bb8 <
    39d707097a0820c6e87eff4195f0940e8ff1147e
  - >-
    Linux >= 95246d1ec80b8d19d882cd8eb7ad094e63b41bb8 <
    69fafae4eb2c9fc9bcff1bcbfcccf5d197434d75
  - >-
    Linux >= 95246d1ec80b8d19d882cd8eb7ad094e63b41bb8 <
    7cc237e3bc1733928313d2462b413ae441b0eef3
  - >-
    Linux >= 95246d1ec80b8d19d882cd8eb7ad094e63b41bb8 <
    18fdd0978ec3dda0ff6865cd273e47e022180710
  - >-
    Linux >= 95246d1ec80b8d19d882cd8eb7ad094e63b41bb8 <
    f94e62d21faad5e244d0874598a4d0ebbc0ea405
  - >-
    Linux >= 95246d1ec80b8d19d882cd8eb7ad094e63b41bb8 <
    4f166adb5cb0525d9e32d45729fd8f28c80acbee
  - Linux 5.17
published: '2026-09-17'
updated: '2026-09-17'
sourceUpdated: '2026-09-17T17:18:14.153'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-93182'
references:
  - url: 'https://git.kernel.org/stable/c/18fdd0978ec3dda0ff6865cd273e47e022180710'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/39d707097a0820c6e87eff4195f0940e8ff1147e'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/4f166adb5cb0525d9e32d45729fd8f28c80acbee'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/69fafae4eb2c9fc9bcff1bcbfcccf5d197434d75'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/7cc237e3bc1733928313d2462b413ae441b0eef3'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/f94e62d21faad5e244d0874598a4d0ebbc0ea405'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
tags:
  - nvd
  - cve.org
ingestedAt: '2026-09-17T16:21:47.728Z'
epss: 0.00215
epssPercentile: 0.10504
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

sched/fair: Fix overflow in update_tg_cfs_runnable()

A divide-by-zero crash is observed when running hackbench:

   [14697.488452] CPU: 112 UID: 0 PID: 124791 Comm: hackbench Not tainted 7.1.0-rc2+
   [14697.492627] RIP: 0010:propagate_entity_load_avg+0x35f/0x3e0
   [14697.506799]  <TASK>
   [14697.507411]  __dequeue_task+0x2b4/0xc70
   [14697.508677]  dequeue_task_fair+0x36/0x370
   [14697.509047]  dequeue_task+0x101/0x2f0
   [14697.509426]  __schedule+0x1b1/0x1a00
   [14697.510868]  anon_pipe_read+0x3da/0x450
   [14697.511400]  vfs_read+0x361/0x390
   [14697.512053]  __x64_sys_read+0x19/0x30

The divide-by-zero happens here:

  if (scale_load_down(gcfs_rq->load.weight)) {
           load_sum = div_u64(gcfs_rq->avg.load_sum,
                              scale_load_down(gcfs_rq->load.weight));
  }

gcfs_rq->load.weight is an insane large value and is truncated
to the lower 32 bits by div_u64, which happen to be 0.

Using AI for investigation, the cause is a u32 overflow in
update_tg_cfs_runnable(), and flat pickup became a victim when using
tg_tasks():

   u32 new_sum, divider;
   ...
   new_sum = se->avg.runnable_avg * divider; <-- boom

The following sequence shows how this triggers the crash:

   propagate_entity_load_avg()
     update_tg_cfs_runnable()     # u32 overflow corrupts runnable_sum

   __update_load_avg_cfs_rq()
     ___update_load_avg()         # computes insane runnable_avg
   update_tg_load_avg()           # propagates to tg->runnable_avg

   update_cfs_group()
     calc_concur_shares()
       tg_tasks()                 # long-to-int truncation, negative nr
     reweight_entity()            # corrupted se->load.weight
       update_load_add()          # corrupted cfs_rq->load.weight

   propagate_entity_load_avg()
     update_tg_cfs_load()
       div_u64()                  # divide-by-zero

Fix by widening new_sum from u32 to u64 (no need to force tg_tasks()
to return unsigned long after this fix)

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.