CVE-2026-23371: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-23371 is a scheduling flaw in the Linux kernel's SCHED_DEADLINE subsystem, specifically a missing ENQUEUE_REPLENISH flag during Priority Inheritance (PI) de-boosting. When a DEADLINE task holding a PI mutex is downgraded to a lower priority class via sched_setscheduler(), it fails to properly inherit DEADLINE parameters from waiting donor tasks, leading to bandwidth accounting corruption. The vulnerability affects Linux kernel versions 4.19.257+, 5.4.212+, 5.10.1 through 6.19.7, and 7.0-rc1 through 7.0-rc7. It was published on March 25, 2026, and carries a CVSS v3.1 base score of 5.5 (Medium) (Red Hat Advisory, Red Hat Bugzilla).

The root cause is classified as CWE-372 (Incomplete Internal State Distinction) — the kernel scheduler fails to distinguish between a task that previously inherited DEADLINE parameters and one that did not, when the task transitions to a lower scheduling class. The bug manifests in a three-step scenario: (1) a DEADLINE donor task blocks on a PI mutex held by another DEADLINE task that does not inherit parameters (e.g., it already has a shorter deadline); (2) sched_setscheduler() downgrades the holder to a lower priority class while it still holds the mutex; (3) the holder should inherit DEADLINE parameters from the donor with ENQUEUE_REPLENISH set, but this inheritance is skipped. The result is that enqueue_task_dl() does not recognize the holder as boosted, causing running_bw underflow and kernel WARNING messages at kernel/sched/deadline.c:239. The fix introduces a new __setscheduler_dl_pi() function to detect and handle this transition correctly (Red Hat Bugzilla).

Exploitation causes bandwidth accounting corruption in the Linux kernel's deadline scheduler, leading to system instability and incorrect real-time task scheduling. The primary impact is on availability — affected systems may emit kernel WARNING messages (sched: DL de-boosted task PID [X]: REPLENISH flag missing) and experience scheduling failures, which is particularly severe in real-time and safety-critical environments that rely on SCHED_DEADLINE. There is no confidentiality or integrity impact; the vulnerability does not enable privilege escalation or data exfiltration (Red Hat Advisory).

There is no known public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the time of reporting. The vulnerability requires low-privilege local access to trigger via sched_setscheduler() system calls, and can be reproduced using tools like stress-ng --schedpolicy 0 on an RT kernel on multi-core systems. The EPSS score is 0.018% (0.000180), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (Red Hat Advisory, Feedly).

• Logs: Kernel log messages containing sched: DL de-boosted task PID [X]: REPLENISH flag missing in /var/log/kern.log or dmesg output.
• Logs: Kernel WARNING at kernel/sched/deadline.c:239 with call trace including dequeue_task_dl, deactivate_task, push_dl_task, and dl_task_timer.
• Logs: Messages indicating running_bw underflow in kernel scheduler output.
• Process: Unusual behavior or stalls in processes using SCHED_DEADLINE scheduling policy, particularly on systems running stress-ng or similar real-time workload tools.

Patches are available via two upstream kernel commits: ba1c22924ddcc280672a2a06a9ca99ee3a1b92c3 and d658686a1331db3bb108ca079d76deb3208ed949, which introduce the __setscheduler_dl_pi() function to correctly handle DEADLINE parameter inheritance during priority class downgrades. Administrators should update to patched kernel versions in the 4.19, 5.4, and 5.10+ stable branches (any version after the fix commits). As an immediate workaround, avoid using sched_setscheduler() to change SCHED_DEADLINE tasks to lower priority classes while they hold PI mutexes, or restrict access to sched_setscheduler() where not operationally required (Red Hat Bugzilla, Red Hat Advisory).

The vulnerability was reported via the upstream Linux CVE announcement list (lore.kernel.org/linux-cve-announce) and tracked in Red Hat Bugzilla. The Yocto Project security mailing list discussed the CVE across multiple messages, indicating awareness in embedded and real-time Linux communities. No significant public researcher commentary or media coverage has been identified beyond standard vulnerability tracking (Red Hat Bugzilla).