CVE-2026-93182: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-93182 is an integer overflow vulnerability in the Linux kernel's Completely Fair Scheduler (CFS) that causes a divide-by-zero kernel crash, resulting in a Denial of Service. The flaw resides in the update_tg_cfs_runnable() function within sched/fair.c, where a u32 overflow corrupts the runnable_sum value, which subsequently propagates through the scheduler and triggers a divide-by-zero in propagate_entity_load_avg(). The vulnerability affects Linux kernel versions from 5.17 onward, with fixes backported to stable releases 6.1.188, 6.6.157, 6.12.110, 6.18.52, 7.2.6, and 7.3-rc1. It was published on September 17, 2026, with a CVSS category estimate of Medium (GitHub Advisory).

The root cause is an integer overflow (CWE-190) in update_tg_cfs_runnable(), where the variable new_sum is declared as u32 but is assigned the product of se->avg.runnable_avg * divider, which can exceed the 32-bit unsigned integer maximum. The overflowed new_sum corrupts runnable_sum, which then propagates through __update_load_avg_cfs_rq() and ___update_load_avg(), producing an abnormally large runnable_avg. This corrupted value flows into update_tg_load_avg(), update_cfs_group(), calc_concur_shares(), and tg_tasks(), where a long-to-int truncation produces a negative task count, ultimately corrupting cfs_rq->load.weight. When div_u64() is subsequently called in propagate_entity_load_avg(), the corrupted weight is truncated to zero in the lower 32 bits, causing a divide-by-zero crash. The fix widens new_sum from u32 to u64, eliminating the overflow (GitHub Advisory).

Successful exploitation causes a kernel panic (divide-by-zero crash), rendering the affected system completely unresponsive and requiring a reboot. Any local user capable of running scheduler-intensive workloads (such as hackbench) can trigger this condition, making it a local Denial of Service vulnerability. There is no evidence of confidentiality or integrity impact; the sole consequence is system availability loss (GitHub Advisory).

There is no public proof-of-concept exploit code and no evidence of in-the-wild exploitation as of the publication date. The vulnerability requires local access to the system to trigger the scheduler-intensive workload path. No threat actor attribution, EPSS score, or CISA KEV catalog listing has been reported for this CVE (GitHub Advisory).

1. Gain local access: Obtain a local user account on a vulnerable Linux system running kernel version 5.17 or later (up to the patched stable releases).
2. Trigger scheduler-intensive workload: Execute a workload that stresses the CFS task group scheduler, such as running hackbench with multiple threads/processes to create high task group scheduling pressure.
3. Induce u32 overflow: The high scheduling load causes update_tg_cfs_runnable() to compute new_sum = se->avg.runnable_avg * divider where the result exceeds the u32 maximum, corrupting runnable_sum.
4. Propagate corruption: The corrupted value flows through __update_load_avg_cfs_rq(), update_tg_load_avg(), update_cfs_group(), and tg_tasks(), producing a corrupted cfs_rq->load.weight.
5. Trigger divide-by-zero: When propagate_entity_load_avg() calls div_u64() with the corrupted weight (truncated to zero in lower 32 bits), a divide-by-zero kernel panic occurs, crashing the system (GitHub Advisory).

• Logs: Kernel crash log entries referencing propagate_entity_load_avg+0x35f/0x3e0, __dequeue_task, dequeue_task_fair, or __schedule in the stack trace; kernel oops messages indicating a divide-by-zero error in the scheduler subsystem.
• Process: Unusual or repeated execution of scheduler-stress tools such as hackbench by non-privileged users.
• System Behavior: Sudden system unresponsiveness or reboot without administrative action, particularly on multi-core systems under high scheduling load (GitHub Advisory).

Apply the available kernel patches fixing the u32 overflow in update_tg_cfs_runnable() by widening new_sum to u64. Fixed versions include Linux kernel 6.1.188, 6.6.157, 6.12.110, 6.18.52, 7.2.6, and 7.3-rc1. Patch commits are available at the kernel stable tree for each affected branch. As a temporary workaround until patching is feasible, restrict local user access to scheduler-intensive workloads or limit the ability to run tools like hackbench on production systems (GitHub Advisory).