Linux kernel RT scheduler: RT_PUSH_IPI can livelock a busy many-core node under softirq load

Impact

On non-PREEMPT_RT kernels, softirqs run in interrupt context, so an RT_PUSH_IPI that lands on a CPU busy in softirq cannot complete its reschedule until the softirq finishes. The CPU stays marked RT-overloaded, other CPUs keep sending IPIs, and the maintainers report an observed live lock on a large machine doing heavy network traffic where softirqs consumed 500us out of every 750us. The fix turns RT_PUSH_IPI off by default outside PREEMPT_RT. This is a node-availability bug, not a privilege bug: the shape it takes on a GPU node is a many-core box carrying RDMA or NIC softirq load plus RT-priority threads, exactly the profile of a storage or fabric-heavy training node, wedging until it is power-cycled. NVD scores it AV:N with availability-only impact, but the record describes a workload-triggered livelock rather than a packet an attacker sends; treat network reachability as a contributing load factor, not a proven remote trigger.

Who can reach it

No authentication path is described. The condition is reached by workload: a large-CPU non-PREEMPT_RT host running RT-priority tasks while sustained softirq load (heavy networking) occupies CPUs. Anyone who can drive enough traffic at such a node contributes to the load, but the record does not establish a deliberate remote trigger.

What to do

Update to a stable kernel carrying the fix and reboot the affected nodes; the change is a scheduler feature default, so it takes effect only on the new kernel. Before the reboot window, an operator on an affected kernel can clear the same condition at runtime by disabling the RT_PUSH_IPI scheduler feature (the fix does exactly this by default) and by checking whether RT-priority threads are actually needed on nodes with heavy softirq load.

References

Related entries

• Linux kernel libceph: a monmap advertising zero monitors hits a BUG_ON and takes down the client nodeCVE-2026-68155 · Linux kernel libceph (ceph_monmap_decode, zero-monitor monmap)High
• Linux kernel libceph: NULL dereference in CRUSH locality lookup when a parent bucket's type name is missingCVE-2026-68157 · Linux kernel libceph (get_immediate_parent CRUSH type name lookup)High
• Linux kernel (net/tls): A remote peer sends a zero-length TLS 1.3 application_data record - which the RFC explicitlyCVE-2026-72330 · Linux kernel (net/tls)High
• Linux kernel (drivers/nvme/target): A client that completes the TLS handshake against the NVMe-oF TCP target and thenCVE-2026-74385 · Linux kernel (drivers/nvme/target)High
• Linux kernel (drivers/nvme/target): Every connection that dies partway through queue allocation on the NVMe-oF TCPCVE-2026-74386 · Linux kernel (drivers/nvme/target)High
• Linux kernel libiscsi: out-of-bounds read leaks stale connection data into the SCSI sense bufferCVE-2026-74557 · Linux kernel libiscsi (SCSI Response sense-data bounds check)High