# CVE-2025-68780: sched/deadline: only set free_cpus for online runqueues

> A logic error in the Linux kernel deadline scheduler can cause tasks to be pushed to offline CPUs, resulting in a denial of service.

- **Severity:** Not scored
- **Exploited in the wild:** Not known
- **Login needed:** Not needed
- **Attackable:** Local or same network only
- **Victim action needed:** Not needed
- **Fix available:** Yes
- **Published:** 13 Jan 2026
- **Updated:** 11 May 2026
- **Also known as:** AZL-74495, BELL-CVE-2025-68780, DEBIAN-CVE-2025-68780, GHSA-386q-4477-2c5h, ROOT-OS-DEBIAN-11-CVE-2025-68780, ROOT-OS-UBUNTU-2204-CVE-2025-68780, ROOT-OS-UBUNTU-2404-CVE-2025-68780, UBUNTU-CVE-2025-68780

## What is CVE-2025-68780?

CVE-2025-68780 is a denial of service vulnerability in Linux, published on 13 Jan 2026. It can only be exploited from the same machine or local network, with no action from the victim.

### Official description

In the Linux kernel, the following vulnerability has been resolved:

sched/deadline: only set free_cpus for online runqueues

Commit 16b269436b72 ("sched/deadline: Modify cpudl::free_cpus
to reflect rd->online") introduced the cpudl_set/clear_freecpu
functions to allow the cpu_dl::free_cpus mask to be manipulated
by the deadline scheduler class rq_on/offline callbacks so the
mask would also reflect this state.

Commit 9659e1eeee28 ("sched/deadline: Remove cpu_active_mask
from cpudl_find()") removed the check of the cpu_active_mask to
save some processing on the premise that the cpudl::free_cpus
mask already reflected the runqueue online state.

Unfortunately, there are cases where it is possible for the
cpudl_clear function to set the free_cpus bit for a CPU when the
deadline runqueue is offline. When this occurs while a CPU is
connected to the default root domain the flag may retain the bad
state after the CPU has been unplugged. Later, a different CPU
that is transitioning through the default root domain may push a
deadline task to the powered down CPU when cpudl_find sees its
free_cpus bit is set. If this happens the task will not have the
opportunity to run.

One example is outlined here:
https://lore.kernel.org/lkml/20250110233010.2339521-1-opendmb@gmail.com

Another occurs when the last deadline task is migrated from a
CPU that has an offlined runqueue. The dequeue_task member of
the deadline scheduler class will eventually call cpudl_clear
and set the free_cpus bit for the CPU.

This commit modifies the cpudl_clear function to be aware of the
online state of the deadline runqueue so that the free_cpus mask
can be updated appropriately.

It is no longer necessary to manage the mask outside of the
cpudl_set/clear functions so the cpudl_set/clear_freecpu
functions are removed. In addition, since the free_cpus mask is
now only updated under the cpudl lock the code was changed to
use the non-atomic __cpumask functions.

## Which versions are affected by CVE-2025-68780?


## How do I fix CVE-2025-68780?

Apply the vendor's patch.

## Is CVE-2025-68780 being exploited?

There is no known exploitation of CVE-2025-68780 in the wild and no public exploit code.

## Fix prompt for AI coding agents

```text
Check this codebase for CVE-2025-68780 and fix it if it is affected.

What it is: CVE-2025-68780 is a denial of service vulnerability in Linux, published on 13 Jan 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Exploitation: There is no known exploitation of CVE-2025-68780 in the wild and no public exploit code.

Affected product: Linux. No package-level version data is available, so check the vendor advisory linked from the reference page.

Task:
1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.
2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.
3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.
4. Run the tests and summarise what changed and why.
5. If nothing in the project is affected, say so and change nothing.

Reference: https://insights.sbomify.com/CVE-2025-68780/ (Markdown: https://insights.sbomify.com/CVE-2025-68780/index.md)
```

## Sources

- CVE record: https://www.cve.org/CVERecord?id=CVE-2025-68780
- NVD: https://nvd.nist.gov/vuln/detail/CVE-2025-68780
- OSV: https://osv.dev/vulnerability/CVE-2025-68780

---
From sbomify Insights: https://insights.sbomify.com/CVE-2025-68780/
Summaries are generated and may contain mistakes; the official description above is the record.