CVE-2025-68333
MediumCVSS 5.5Exploitation Probability (EPSS)
Low risk1th percentile - higher than 1% of all known CVEs
Summary
In the Linux kernel sched_ext subsystem, a possible deadlock exists in deferred_irq_workfn() on PREEMPT_RT=y kernels. When the function runs in the per-CPU irq_work/* task context without interrupts disabled, an interrupt may re-acquire the same rq->__lock. The fix forces the function to always run in hard-irq context.
Risk Assessment
This can lead to a system deadlock on real-time kernels (PREEMPT_RT), causing the machine to hang. It affects systems using the sched_ext scheduler in RT configuration.
Recommendation
Update the Linux kernel to a version containing the fix that uses IRQ_WORK_INIT_HARD() to initialize rq->scx.deferred_irq_work.
Other vulnerabilities in Linux kernel (sched_ext)
See all- CVE-2026-89519Low risk· EPSS 9%
In the Linux kernel's sched_ext scheduler, the SCX_RQ_BAL_KEEP flag tells the pick to keep running the previous task, a leftover from when balancing and picking were separate operations. An rq-level flag only works while dispatches and picks pair up one to one, which core scheduling breaks: selections interleave through dispatch's lock drops and a pick can consume a stale flag, keeping a task that has since been dequeued.
- CVE-2026-89516Low risk· EPSS 9%
In the Linux kernel's sched_ext scheduler, scx_bpf_dsq_reenq() queues a deferred reenq (dru) that runs from run_deferred(), not ops.dispatch(). If the DSQ is destroyed before the dru runs, process_deferred_reenq_users() sees dsq->id == SCX_DSQ_INVALID and hits the BUG_ON. destroy_dsq() doesn't flush pending drus, so it should just skip.
Original NVD description (English source)
In the Linux kernel, the following vulnerability has been resolved: sched_ext: Fix possible deadlock in the deferred_irq_workfn() For PREEMPT_RT=y kernels, the deferred_irq_workfn() is executed in the per-cpu irq_work/* task context and not disable-irq, if the rq returned by container_of() is current CPU's rq, the following scenarios may occur: lock(&rq->__lock); <Interrupt> lock(&rq->__lock); This commit use IRQ_WORK_INIT_HARD() to replace init_irq_work() to initialize rq->scx.deferred_irq_work, make the deferred_irq_workfn() is always invoked in hard-irq context.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS