CVE-2026-89517

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

sched_ext: Fix rq->core_pick corruption under core scheduling

Core scheduling's pick_next_task() picks what to run on every SMT sibling of

the core in a single pass under the shared core-wide rq lock. The selection

state is consistent only while the lock is held continuously, so

->pick_task() originally could not release it. However, since 4c95380701f5

("sched/ext: Fold balance_scx() into pick_task_scx()"), sched_ext runs

dispatch from inside the pick and dispatching can drop the rq lock. To

support this, pick_next_task() has been updated to restart the whole

selection when a pick returns RETRY_TASK after releasing the lock.

When selections on the same core interleave through the dropped lock, they

corrupt each other's state: one clears the other's rq->core_pick leading to

a NULL deref, or invalidates its keep-the-previous-task decision leaving a

dequeued task running, which deadlocks the next wakeup and matches the

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References