{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-99217", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-09-25T10:25:14.401Z", "datePublished": "2026-11-02T16:06:30.653Z", "dateUpdated": "2026-11-02T16:06:30.653Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-11-02T16:06:30.653Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nfork: release the files of a failed fork after sched_cancel_fork()\n\nReorder copy_process() cleanup so sched_fork() taking scx_fork_rwsem\nscx_pre_fork() is safe and isn't held around exiting files. Right now, a\nfork that fails while another thread closed the bpf link fd will\ndeadlock against its own read side. It also blocks every fork on the\nsystem:\n\n copy_process() holds scx_fork_rwsem for read\n exit_files()\n close_files()\n filp_close_sync()\n bpf_scx_unreg()\n kthread_flush_work() waits for the disable work\n scx_root_disable()\n percpu_down_write(&scx_fork_rwsem)\n\nSimply release the child's files after sched_cancel_fork() dropped the\nlock. The task starts out as a copy of its parent so p->files points to\nthe parent's table until copy_files() replaces it. exit_files() must not\nrun for a fork that failed before that. Clear p->files up front so\nexit_files() is a no-op for those and make copy_files() set it\nexplicitly for CLONE_FILES."}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["kernel/fork.c"], "versions": [{"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2", "lessThan": "27e1cbf8ec5f7117f6bb2d2e44030ac055f09097", "status": "affected", "versionType": "git"}, {"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2", "lessThan": "f7ac8500d58e7684d37403553b1dea90ee2b27b1", "status": "affected", "versionType": "git"}, {"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2", "lessThan": "14c7de6ca239326b79fd3f7aee55dfada1bb72ab", "status": "affected", "versionType": "git"}, {"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2", "lessThan": "afa8eb069694bd9f845e5e44eac6e81cbc06780e", "status": "affected", "versionType": "git"}, {"version": "0", "lessThan": "6.12.115", "status": "affected", "versionType": "semver"}, {"version": "0", "lessThan": "6.18.60", "status": "affected", "versionType": "semver"}, {"version": "0", "lessThan": "7.2.14", "status": "affected", "versionType": "semver"}, {"version": "0", "lessThan": "7.3.1", "status": "affected", "versionType": "semver"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["kernel/fork.c"], "versions": [{"version": "6.12.115", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.60", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2.14", "lessThanOrEqual": "7.2.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.3.1", "lessThanOrEqual": "7.3.*", "status": "unaffected", "versionType": "semver"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionEndExcluding": "6.12.115"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionEndExcluding": "6.18.60"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionEndExcluding": "7.2.14"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionEndExcluding": "7.3.1"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/27e1cbf8ec5f7117f6bb2d2e44030ac055f09097"}, {"url": "https://git.kernel.org/stable/c/f7ac8500d58e7684d37403553b1dea90ee2b27b1"}, {"url": "https://git.kernel.org/stable/c/14c7de6ca239326b79fd3f7aee55dfada1bb72ab"}, {"url": "https://git.kernel.org/stable/c/afa8eb069694bd9f845e5e44eac6e81cbc06780e"}], "title": "fork: release the files of a failed fork after sched_cancel_fork()", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["kernel/fork.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "27e1cbf8ec5f7117f6bb2d2e44030ac055f09097", "status": "affected", "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2", "versionType": "git"}, {"lessThan": "f7ac8500d58e7684d37403553b1dea90ee2b27b1", "status": "affected", "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2", "versionType": "git"}, {"lessThan": "14c7de6ca239326b79fd3f7aee55dfada1bb72ab", "status": "affected", "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2", "versionType": "git"}, {"lessThan": "afa8eb069694bd9f845e5e44eac6e81cbc06780e", "status": "affected", "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2", "versionType": "git"}, {"lessThan": "6.12.115", "status": "affected", "version": "0", "versionType": "semver"}, {"lessThan": "6.18.60", "status": "affected", "version": "0", "versionType": "semver"}, {"lessThan": "7.2.14", "status": "affected", "version": "0", "versionType": "semver"}, {"lessThan": "7.3.1", "status": "affected", "version": "0", "versionType": "semver"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["kernel/fork.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.115", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.60", "versionType": "semver"}, {"lessThanOrEqual": "7.2.*", "status": "unaffected", "version": "7.2.14", "versionType": "semver"}, {"lessThanOrEqual": "7.3.*", "status": "unaffected", "version": "7.3.1", "versionType": "semver"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nfork: release the files of a failed fork after sched_cancel_fork()\n\nReorder copy_process() cleanup so sched_fork() taking scx_fork_rwsem\nscx_pre_fork() is safe and isn't held around exiting files. Right now, a\nfork that fails while another thread closed the bpf link fd will\ndeadlock against its own read side. It also blocks every fork on the\nsystem:\n\n copy_process() holds scx_fork_rwsem for read\n exit_files()\n close_files()\n filp_close_sync()\n bpf_scx_unreg()\n kthread_flush_work() waits for the disable work\n scx_root_disable()\n percpu_down_write(&scx_fork_rwsem)\n\nSimply release the child's files after sched_cancel_fork() dropped the\nlock. The task starts out as a copy of its parent so p->files points to\nthe parent's table until copy_files() replaces it. exit_files() must not\nrun for a fork that failed before that. Clear p->files up front so\nexit_files() is a no-op for those and make copy_files() set it\nexplicitly for CLONE_FILES."}], "id": "CVE-2026-99217", "lastModified": "2026-11-02T16:17:45.570", "metrics": {}, "published": "2026-11-02T16:17:45.570", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/14c7de6ca239326b79fd3f7aee55dfada1bb72ab"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/27e1cbf8ec5f7117f6bb2d2e44030ac055f09097"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/afa8eb069694bd9f845e5e44eac6e81cbc06780e"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/f7ac8500d58e7684d37403553b1dea90ee2b27b1"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,27e1cbf8ec5f7117f6bb2d2e44030ac055f09097)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,f7ac8500d58e7684d37403553b1dea90ee2b27b1)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,14c7de6ca239326b79fd3f7aee55dfada1bb72ab)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,afa8eb069694bd9f845e5e44eac6e81cbc06780e)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,6.12.115)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,6.18.60)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,7.2.14)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,7.3.1)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.12.115,6.13.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.60,6.19.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.2.14,7.3.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.3.1,7.4.0)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,27e1cbf8ec5f7117f6bb2d2e44030ac055f09097)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,f7ac8500d58e7684d37403553b1dea90ee2b27b1)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,14c7de6ca239326b79fd3f7aee55dfada1bb72ab)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,afa8eb069694bd9f845e5e44eac6e81cbc06780e)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,6.12.115)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,6.18.60)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,7.2.14)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,7.3.1)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.12.115,6.13.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.60,6.19.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.2.14,7.3.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.3.1,7.4.0)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-11-02T17:45:12.000780+00:00", "updated": "2026-11-02T17:45:12.196527+00:00", "vendors": ["linux", "linux$PRODUCT$linux", "linux$PRODUCT$linux_kernel"], "weaknesses": ["CWE-362"]}