Executive brief
The Linux kernel's process scheduler extension (sched_ext) contains a deadlock vulnerability in cgroup lock management. This can cause the system to hang when concurrent cgroup operations (enabling/disabling the scheduler, directory removal, and CPU weight configuration) occur simultaneously. A system hang may disrupt service availability until the system is restarted.
Technical details
The vulnerability is a deadlock condition in the scx_cgroup_lock() function within the sched_ext component. The issue occurs because scx_cgroup_lock() was acquiring scx_cgroup_ops_rwsem (a read-write semaphore) before cgroup_lock() (a mutex). Under concurrent operations—specifically when CPU weight is being written while cgroup removal is in progress and the scheduler is being enabled/disabled—a circular wait dependency forms through the kernfs layer. The enable path waits for cgroup_mutex, the rmdir path (holding cgroup_mutex) waits in kernfs_drain() for the write's active reference, and the write waits for the rwsem. The fix reorders the lock acquisition in scx_cgroup_lock() and scx_cgroup_unlock() to take cgroup_lock() first, breaking the dependency cycle. This affects Linux kernel versions 6.18 and later where sched_ext cgroup support was introduced. The fix has been applied upstream and backported to stable branches.
Affected products
- Linux Linux kernel v6.18 and later
Timeline
- 2026-08-22: disclosed: Advisory published
- 2026-07-16: patched: Original fix committed upstream by Tejun Heo
- 2026-08-23: other: Stable kernel backport by Greg Kroah-Hartman