{"cve":"CVE-2026-93150","nvd":{"published":"2026-09-17T17:18:10.213","modified":"2026-10-21T13:21:01.017","status":"Received","description":"In the Linux kernel, the following vulnerability has been resolved:\n\ncgroup/cpuset: Make nr_deadline_tasks an atomic_t\n\nThe nr_deadline_tasks variable in the cpuset structure was introduced by\ncommit 6c24849f5515 (\"sched/cpuset: Keep track of SCHED_DEADLINE task\nin cpusets\"). It is reported by sashiko [1] that nr_deadline_tasks\ncan currently be modified by inc_dl_tasks_cs() under rq->lock and\nby cpuset_attach() under cpuset_mutex. So if both updates happen\nsimultaneously, the nr_deadline_tasks variable can be corrupted leading\nto incorrect operations down the road.\n\nFix that by changing its type to atomic_t so that nr_deadline_tasks\nare always atomically updated. This fix patch is a low hanging fruit.\nIt can handle some of the races between a concurrent sched_setscheduler()\nand cpuset_can_attach()/cpuset_attach() calls, but not all of them like\nthe other issue raised by sashiko [2]. This will be handled hopefully\nin a future follow up patch.\n\n[1] https://sashiko.dev/#/patchset/20260626181923.133658-1-longman%40redhat.com\n[2] https://sashiko.dev/#/patchset/20260630033344.352702-1-longman%40redhat.com","cvss_v4":null,"cvss_v3":null,"cwes":[],"references":["https://git.kernel.org/stable/c/642648fa7595241e4d491add5007bc33f11defb5","https://git.kernel.org/stable/c/78d9daf5e13ad1448b7dfebac949936710ec7565","https://git.kernel.org/stable/c/95220e1f18f6321008f021abc7d6f581f64bcb82","https://git.kernel.org/stable/c/e422b32e6a57269ca8164c60674a78bee85cf5fb","https://git.kernel.org/stable/c/e5965ae3f7c918151b87e5c925b7978afbeaf638"],"products":[],"source":"nvd","synced_at":"2026-10-22T16:41:11.231219466+00:00"},"epss":{"cve":"CVE-2026-93150","score":0.00201,"percentile":0.09819,"date":"2026-10-25"},"kev":null,"osv":[],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}