> Source: [sk1000157](https://support.checkpoint.com/results/sk/sk1000157)

# sk1000157 - High CPU utilization on FWK cores in VSX with SecureXL User Mode

| Property | Value |
|----------|-------|
| Solution ID | sk1000157 |
| Date Created | 2026-09-16 |
| Last Modified | 2026-09-17 |
| Technical Level | General |
| Products | Check Point Firewall |
| Versions | R82.20 |
| OS | Gaia |

## Symptoms

- * CoreXL Firewall Worker processes show 99% to 100% CPU utilization.
* 'top -H' shows pkt_thread running on non-SND core.
  * You can Identify FW (non-SND) cores via CPView or $FWDIR/log/dsd.elg, identify SND cores with 'mq_mng -ov'
* CPView also shows the high CPU, even when system is idle.
* Spike Detective perf outputs show usim_x86 pkt_thread_\* functions on FW core.

## Cause

The issue is caused by a CPU affinity assignment problem in VSX environments when SecureXL User Mode is enabled.

In some scenarios after boot, the VSX Gateway does not correctly assign CPU cores between:

* Firewall Worker instances, also known as `FWK` or `CoreXL_FW`
* Secure Network Distributor (SND) packet-processing threads, such as `pkt_thread`

As a result, SND-related packet processing can run on CPU cores that should be dedicated to Firewall Worker instances. This incorrect CPU affinity causes the affected cores to remain at 99% to 100% utilization and causes repeated CPU spike events.

## Solution

The fix has been integrated into R82 JHF Take 126 under fix ID PMTR-127257.

For R81.20 and R82.10, please [C](https://www.checkpoint.com/support-services/contact-support/)[ontact Check Point Support](https://www.checkpoint.com/support-services/contact-support/) to get a Hotfix for this issue.

A Support Engineer will make sure the Hotfix is compatible with your environment before providing it. For faster resolution and verification, collect these files:

1. [CPinfo](https://support.checkpoint.com/results/sk/sk92739) file from the Management Server involved in the case.
2. [CPinfo](https://support.checkpoint.com/results/sk/sk92739) file from the Security Gateway / each Cluster Member / Security Group involved in the case.

**Hotfix installation instruction** Refer to [How to Install a Hotfix](https://support.checkpoint.com/results/sk/sk168597).

---

# Agent Instructions

This content is from the Check Point Support Center (https://support.checkpoint.com), the official knowledge base for Check Point cybersecurity products.

## Navigating This Knowledge Base

- **Complete index**: [llms.txt](https://support.checkpoint.com/llms.txt)
- **All SK articles**: [SecureKnowledge Sitemap](https://support.checkpoint.com/sitemaps/secureknowledge-sitemap-index.xml)
- **SK article URL pattern**: `https://support.checkpoint.com/results/sk/{skId}`
- **Markdown responses**: AI bot User-Agents automatically receive `text/markdown` content