Executive brief
The Linux kernel's process scheduler (sched_ext) contains logic errors in dispatch functions that can cause deadlocks when managing multiple CPU cores. These errors affect kernel process scheduling reliability under certain multi-core configurations, potentially causing system hangs or performance degradation.
Technical details
The vulnerability involves incorrect assumptions in several kernel functions (scx_dsq_move, scx_bpf_sub_dispatch, finish_dispatch, scx_bpf_dsq_reenq, and scx_bpf_dsq_nr_queued) within the sched_ext scheduler's dispatch mechanism. Under core scheduling, dispatch operations can execute on a CPU different from the target run-queue, but these functions assumed this_rq() always refers to the dispatched run-queue. This causes scx_dsq_move() to take an unlocked-context branch and incorrectly acquire locks, potentially leading to deadlock. The fix involves using scx_locked_rq() to track the actual dispatched run-queue context rather than relying on this_rq().
Affected products
- Linux Linux kernel sched_ext scheduler (version range unknown)
Timeline
- 2026-09-11: disclosed