CVE-2026-89520

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

sched/core: Make core-sched flips wait for in-flight selections

Core scheduling's pick_next_task() operates on all sibling rqs under one

acquisition of the shared core-wide lock. A ->pick_task() that releases the

rq lock leaves every sibling __lock momentarily free, letting

__sched_core_flip(false) complete mid-selection and rebind rq_lockp() under

it. The selection resumes on the split locks, touching sibling state it no

longer protects, and __schedule() finally releases a lock that was never

taken while leaking the one that was.

Count in-flight core-wide selections in the leader's rq->core_pick_in_flight

and make __sched_core_flip() wait for the count to drain. The count only

changes under the shared lock, which the flip holds while sampling, so no

other ordering is needed. The wait can repeat while selections overlap, but

the flip backs off between samples and flips are rare cookie-lifetime

events.

sched_core_cp

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References