CVE-2026-99217

In the Linux kernel, the following vulnerability has been resolved:

fork: release the files of a failed fork after sched cancel fork()

Reorder copy process() cleanup so sched fork() taking scx fork rwsem scx pre fork() is safe and isn't held around exiting files. Right now, a fork that fails while another thread closed the bpf link fd will deadlock against its own read side. It also blocks every fork on the system:

copy process() holds scx fork rwsem for read exit files() close files() filp close sync() bpf scx unreg() kthread flush work() waits for the disable work scx root disable() percpu down write(&scx fork rwsem)

Simply release the child's files after sched cancel fork() dropped the lock. The task starts out as a copy of its parent so p->files points to the parent's table until copy files() replaces it. exit files() must not run for a fork that failed before that. Clear p->files up front so exit files() is a no-op for those and make copy files() set it explicitly for CLONE FILES.