Executive brief
The Linux kernel's scheduler extension (sched_ext) component had a flawed mechanism for tracking which task should run next, using a flag that could become stale when tasks were dequeued. This caused the scheduler to incorrectly attempt to keep running a task that was no longer eligible, potentially leading to undefined behavior or system instability. The fix replaces this flag-based approach with explicit return values that are safer with modern scheduler operations.
Technical details
The vulnerability exists in the sched_ext scheduler subsystem's handling of the SCX_RQ_BAL_KEEP flag in the task dispatch and picking logic. The root cause is that an rq-level flag cannot reliably communicate dispatch decisions to the pick phase when core scheduling interleaves these operations through lock drops; a pick operation could consume a stale flag and continue executing a task that had been dequeued in the interim. The fix introduces an explicit enum (scx_dsp_verdict) with values SCX_DSP_NONE, SCX_DSP_LOCAL, and SCX_DSP_PREV, returning this verdict directly from scx_dispatch_sched() and balance_one() rather than using the flag. This ensures the scheduling decision travels with the dispatch that made it. Affected versions are v6.19 and later. The patch refactors do_pick_task_scx() into a new dispatch_pick() function to encapsulate pick-side invocation and post-dispatch checks.
Affected products
- Linux Linux kernel v6.19+
Timeline
- 2026-09-11: disclosed
- 2026-08-07: patched