Linux kernel RT scheduler: self-IPI storm in rto_next_cpu() can hard-lock a CPU

Impact

When one CPU is RT-overloaded and other CPUs run RT load balancing, rd->rto_loop_next keeps advancing and rto_next_cpu() re-selects the initiating CPU, which then queues IPI work to itself indefinitely. The result is a continuous self-interrupt loop and a CPU hardlockup. This is reachable from ordinary workload shape rather than a crafted exploit: a node that mixes SCHED_FIFO/RR threads (real-time inference pinning, latency-sensitive data-plane threads, some RDMA and telemetry agents) with CFS work can wedge a CPU and in practice take the whole node out, which on a GPU host means losing every co-tenant job on it. No confidentiality or integrity impact.

Who can reach it

Local. Requires the ability to run RT-priority tasks (CAP_SYS_NICE or an RT-capable rlimit) on a multi-CPU node, or simply an existing RT workload that creates the overload condition. Not remotely triggerable.

What to do

Update to a stable kernel carrying the fix (five stable commits linked) and reboot the node; the fix filters the initiating CPU in rto_next_cpu(). Until then the only practical mitigation is to avoid granting RT scheduling to tenant workloads and to keep RT threads off nodes that also run CPU-bound CFS work in kernel space.

References

Related entries

• Linux kernel SUNRPC auth_gss: gss_auth reference leaked when gss_alloc_msg allocation failsCVE-2026-45964 · Linux kernel SUNRPC auth_gss (gss_alloc_msg kref leak on kstrdup_const failure)Medium
• Linux kernel KVM nSVM: interrupt shadow not synced to cached vmcb12, nested vCPU can hangCVE-2026-45987 · Linux kernel KVM nSVM (vmcb12 interrupt shadow sync)Medium
• Linux kernel KVM: DEBUGCTL and LBR MSRs missing from save/restore, guest branch state lostCVE-2026-46014 · Linux kernel KVM SVM/VMX (DEBUGCTL and LBR MSR save/restore)Medium
• Linux kernel algif_aead: async AEAD requests share the socket IV buffer, IV handling can be inconsistentCVE-2026-46028 · Linux kernel crypto algif_aead (AF_ALG async AEAD IV handling)Medium
• Linux kernel KVM nSVM: failed host CR3 restore on nested #VMEXIT keeps running L1 with corrupted stateCVE-2026-46032 · Linux kernel KVM nSVM (nested_svm_vmexit host CR3 restore)Medium
• Linux kernel KVM nSVM: wrong NextRIP used in vmcb02 after the first L2 VMRUNCVE-2026-46059 · Linux kernel KVM nSVM (vmcb02 NextRIP after nested VMRUN)Medium