In the Linux kernel, the following vulnerability has been resolved:
sched/eevdf: Prevent vlag from going out of bounds in reweight_eevdf()
It was possible to have pick_eevdf() return NULL, which then causes a NULL-deref. This turned out to be due to entity_eligible() returning falsely negative because of a s64 multiplcation overflow.
Specifically, reweight_eevdf() computes the vlag without considering the limit placed upon vlag as update_entity_lag() does, and then the scaling multiplication (remember that weight is 20bit fixed point) can overflow. This then leads to the new vruntime being weird which then causes the above entity_eligible() to go side-ways and claim nothing is eligible.
Thus limit the range of vlag accordingly.
All this was quite rare, but fatal when it does happen.
CVSS Details
- CVSS 3.1 Base Score: 5.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade linux | Jul 27, 2026 | Jul 27, 2026 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | May 20, 2024 |
| Ubuntu | — | Upgrade linux-image-kvmUpgrade linux-image-nvidia-64kUpgrade linux-image-virtual-hwe-24.04Upgrade linux-image-6.8.0-1007-raspiUpgrade linux-image-6.8.0-1007-intelUpgrade linux-image-6.8.0-1008-oracleUpgrade linux-image-oracleUpgrade linux-image-gcpUpgrade linux-image-generic-64k-hwe-24.04Upgrade linux-image-6.8.0-1006-gkeUpgrade linux-image-awsUpgrade linux-image-oem-24.04aUpgrade linux-image-6.8.0-1008-oemUpgrade linux-image-oracle-64kUpgrade linux-image-ibmUpgrade linux-image-6.8.0-38-genericUpgrade linux-image-azureUpgrade linux-image-virtualUpgrade linux-image-6.8.0-1008-ibmUpgrade linux-image-generic-hwe-24.04Upgrade linux-image-ibm-classicUpgrade linux-image-ibm-lts-24.04Upgrade linux-image-azure-fdeUpgrade linux-image-lowlatency-64kUpgrade linux-image-nvidiaUpgrade linux-image-generic-lpaeUpgrade linux-image-6.8.0-1011-awsUpgrade linux-image-oem-24.04Upgrade linux-image-6.8.0-1010-gcpUpgrade linux-image-gkeUpgrade linux-image-generic-64kUpgrade linux-image-6.8.0-1009-nvidiaUpgrade linux-image-6.8.0-38-lowlatencyUpgrade linux-image-lowlatencyUpgrade linux-image-6.8.0-38-generic-64kUpgrade linux-image-intelUpgrade linux-image-6.8.0-1010-azureUpgrade linux-image-6.8.0-1009-nvidia-64kUpgrade linux-image-raspiUpgrade linux-image-genericUpgrade linux-image-6.8.0-1010-azure-fdeUpgrade linux-image-6.8.0-38-lowlatency-64kUpgrade linux-image-6.8.0-1008-oracle-64k | Jul 12, 2024 | May 20, 2024 |
Prioritize with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub