CVE-2026-99085: 
Linux Debian vulnerability analysis and mitigation

CVE-2026-99085 is a denial-of-service vulnerability in the Linux kernel's sched_ext (extensible scheduler) subsystem that can cause a CPU hotplug hang when tasks belonging to a dying CPU remain queued in a BPF-based user-space scheduler. The flaw was published on October 23, 2026, and affects Linux kernel version 6.12 through specific git commits prior to the fix. Fixed versions include kernel 6.12.114, 6.18.58, 7.2.12, and 7.3+. The vulnerability carries an estimated CVSS severity of Medium (GitHub Advisory, Feedly).

The root cause is improper handling of CPU hotplug events within the sched_ext scheduler framework (no CWE formally assigned). When a CPU is taken offline via cpu_down(), its hotplug thread waits in sched_cpu_wait_empty() for the run queue (rq) to drain. However, tasks sitting in a user-space Dispatch Queue (DSQ) or held by the BPF scheduler remain counted on the dying CPU's rq, while the inactive CPU no longer calls ops.dispatch() to retrieve them. This results in two failure modes: (1) another CPU consumes the task without triggering __schedule() on the dying CPU, so the hotplug thread is never woken and cpu_down() hangs while holding cpu_hotplug_lock; or (2) a CPU-affine task cannot be migrated, stalling the offline process until the watchdog ejects the BPF scheduler. The fix re-enqueues all non-local-DSQ tasks when the rq goes offline and changes ops.dispatch() to check SCX_RQ_ONLINE directly rather than stopping at CPU inactivity (GitHub Advisory).

Successful exploitation causes an indefinite system hang (denial of service) by stalling the cpu_down() operation while holding cpu_hotplug_lock, which blocks further CPU hotplug operations system-wide. A local attacker with privileges to trigger CPU hotplug operations can render the affected system unresponsive, requiring a reboot or watchdog intervention. There is no evidence of confidentiality or integrity impact; the vulnerability is limited to availability (GitHub Advisory, Feedly).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the disclosure date (Feedly). Exploitation requires local access and the ability to trigger CPU hotplug operations, significantly limiting the attack surface. No threat actor attribution has been reported, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. EPSS score data is not yet available for this CVE.

Apply the available kernel patches, which are included in Linux kernel versions 6.12.114, 6.18.58, 7.2.12, and 7.3+. The specific fix commits are: f79cd7a2df37, 638ee6bca197, 173ff9d03ec6, and d35a535d3e3e (GitHub Advisory). Until patching is feasible, restrict CPU hotplug operations (cpu_down()) to trusted administrators only, and disable the sched_ext scheduler if it is not required for the workload, reverting to the default Linux scheduler. Monitor systems for unexpected CPU hotplug hangs and watchdog timeout events that may indicate the bug has been triggered.