Executive brief
The Linux kernel's core scheduling feature, which optimizes CPU performance on multi-core processors, contains a synchronization bug that can cause lock corruption and memory safety violations. If the core scheduling mechanism improperly releases and reacquires locks during task selection, an attacker or malicious workload could cause system crashes, data corruption, or denial of service on affected systems.
Technical details
The vulnerability is a race condition in the core-wide task selection logic (pick_next_task()) in kernel/sched/core.c. The pick_next_task() function operates on all sibling run queues under a shared core-wide lock. When a lock-dropping pick_task() callback momentarily releases the rq lock, it allows __sched_core_flip() to complete mid-selection and rebind rq_lockp(), causing the selection to resume on split locks while touching sibling state no longer protected by the core lock. This results in incorrect lock release/acquisition and potential memory corruption. The fix adds tracking of in-flight selections via rq->core_pick_in_flight counter and makes __sched_core_flip() wait for the counter to drain before proceeding. The vulnerability affects Linux kernel v5.14 and later versions that include core scheduling support.
Affected products
- Linux Linux kernel v5.14 and later
Timeline
- 2026-09-11: disclosed: CVE-2026-89520 published
- 2026-08-07: patched: Upstream fix committed by Tejun Heo (commit f3629c63a4af3e491381780bc6c123cb498c4c40)
- 2026-09-07: other: Patch backported to stable trees