Executive brief
The Linux kernel's scheduler extension (sched_ext) component has a race condition in core scheduling that can corrupt task selection state when multiple CPU cores try to pick tasks simultaneously. This can cause kernel deadlocks and hard hangs, particularly under multi-threaded workloads on SMT (simultaneous multi-threading) systems, disrupting system availability.
Technical details
The vulnerability is a state corruption bug in the sched_ext core scheduling pick_next_task() function. When lock drops occur during dispatch operations, concurrent selections on the same core can interleave and corrupt the rq->core_pick state, leading to NULL pointer dereferences or leaving dequeued tasks running. The root cause stems from changes in sched_ext dispatch handling that allow the rq lock to be released during task selection, breaking the atomicity assumption of the core-scheduling logic. The fix ensures selections only commit picks made under a continuously held lock by returning RETRY_TASK when dispatch releases the lock, tracked via rq->scx.lock_drop_seq. The vulnerability affects systems with simultaneous multi-threading enabled and can be reliably triggered by cookied ping-pong workloads, causing kernel deadlocks within seconds.
Affected products
- Linux Linux kernel sched_ext enabled kernels
Timeline
- 2026-09-11: disclosed