In the Linux kernel, the following vulnerability has been resolved:
sched/eevdf: Prevent vlag from going out of bounds in reweight_eevdf()
It was possible to have pick_eevdf() return NULL, which then causes a NULL-deref. This turned out to be due to entity_eligible() returning falsely negative because of a s64 multiplcation overflow.
Specifically, reweight_eevdf() computes the vlag without considering the limit placed upon vlag as update_entity_lag() does, and then the scaling multiplication (remember that weight is 20bit fixed point) can overflow. This then leads to the new vruntime being weird which then causes the above entity_eligible() to go side-ways and claim nothing is eligible.
Thus limit the range of vlag accordingly.
All this was quite rare, but fatal when it does happen.
CVSS Details
- CVSS 3.1 Base Score: 5.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade linux | Jul 27, 2026 | Jul 27, 2026 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | May 20, 2024 |
| Ubuntu | — | Upgrade linux-image-ibm-lts-24.04Upgrade linux-image-kvmUpgrade linux-image-6.8.0-1008-oracleUpgrade linux-image-nvidia-64kUpgrade linux-image-oracle-64kUpgrade linux-image-generic-64k-hwe-24.04Upgrade linux-image-generic-hwe-24.04Upgrade linux-image-azureUpgrade linux-image-ibmUpgrade linux-image-awsUpgrade linux-image-gcpUpgrade linux-image-oracleUpgrade linux-image-6.8.0-38-genericUpgrade linux-image-6.8.0-1008-oemUpgrade linux-image-6.8.0-1007-raspiUpgrade linux-image-6.8.0-1008-ibmUpgrade linux-image-6.8.0-1006-gkeUpgrade linux-image-oem-24.04aUpgrade linux-image-virtualUpgrade linux-image-virtual-hwe-24.04Upgrade linux-image-6.8.0-1007-intelUpgrade linux-image-azure-fdeUpgrade linux-image-ibm-classicUpgrade linux-image-6.8.0-1010-azure-fdeUpgrade linux-image-6.8.0-1009-nvidia-64kUpgrade linux-image-6.8.0-1010-azureUpgrade linux-image-lowlatencyUpgrade linux-image-intelUpgrade linux-image-raspiUpgrade linux-image-6.8.0-1011-awsUpgrade linux-image-6.8.0-1010-gcpUpgrade linux-image-generic-64kUpgrade linux-image-6.8.0-38-lowlatencyUpgrade linux-image-lowlatency-64kUpgrade linux-image-6.8.0-38-lowlatency-64kUpgrade linux-image-nvidiaUpgrade linux-image-gkeUpgrade linux-image-oem-24.04Upgrade linux-image-6.8.0-1008-oracle-64kUpgrade linux-image-generic-lpaeUpgrade linux-image-6.8.0-38-generic-64kUpgrade linux-image-6.8.0-1009-nvidiaUpgrade linux-image-generic | Jul 12, 2024 | May 20, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub