Executive brief
A vulnerability in the Linux kernel's extensible scheduler (sched_ext) could allow a local system to become unresponsive or 'wedge.' The issue occurs when the system is attempting to shut down a custom scheduler; if the process is interrupted at a specific moment, the system may fail to transition back to its default scheduling mode. This results in a total loss of system availability, requiring a hard reboot to restore operations.
Technical details
A race condition exists in kernel/sched/ext.c within the sched_ext (scx) framework. The function scx_claim_exit() atomically sets the exit state, which suppresses further error handling. If the calling task is preempted after calling scx_claim_exit() but before it can queue the helper kthread work (which initiates bypass mode and teardown), and the BPF scheduler fails to reschedule that task, the system enters a deadlocked state where tasks are no longer dispatched. The fix involves disabling preemption across the critical section between claiming the exit and kicking the helper work in scx_disable() and scx_vexit().
Affected products
- Linux Linux Kernel v6.12+
Timeline
- 2026-02-24: patched: Initial patch authored by Tejun Heo
- 2026-05-13: disclosed: CVE-2026-43482 published