Executive brief
The Linux kernel's CPU scheduler contains a logic error in its core scheduling implementation that can occur when task selection functions release and reacquire locks. If multiple CPU cores' scheduling decisions interleave during a lock release, the scheduler can commit inconsistent task assignments or miscalculate forced-idle accounting, potentially causing suboptimal CPU scheduling decisions or task execution anomalies.
Technical details
A race condition exists in the pick_next_task() function within kernel/sched/core.c when the pick_task() implementation can release the runqueue lock. The vulnerability arises because selection state (cookie tracking, forced-idle accounting) derived before the lock release becomes invalid if an interleaving CPU's scheduler updates core state during the lock window. Specifically, the single-CPU fast path may commit an uncookied pick even after the core went "cookied" during the release, and forced-idle state set by interleaving selections corrupts accounting on the restarted pass. The fix consolidates multiple per-loop restart labels into a single restart point above state derivation, ensuring that lock-release retries re-derive all state and that clock validity is re-checked. This affects kernel v6.19 and later (introduced by commit 4c95380701f5). The patch is available in stable branch 88ed5a66467ca2a5148b9997af9c71d8c43060ad.
Affected products
- Linux Linux kernel v6.19+
Timeline
- 2026-09-11: disclosed: CVE-2026-89521 published
- 2026-09-07: patched: Fix committed to stable tree