CVE-2026-89519
Low risk· EPSS 9%Exploitation Probability (EPSS)
Low risk9th percentile - higher than 9% of all known CVEs
Summary
In the Linux kernel's sched_ext scheduler, the SCX_RQ_BAL_KEEP flag tells the pick to keep running the previous task, a leftover from when balancing and picking were separate operations. An rq-level flag only works while dispatches and picks pair up one to one, which core scheduling breaks: selections interleave through dispatch's lock drops and a pick can consume a stale flag, keeping a task that has since been dequeued.
Risk Assessment
This can cause scheduler state inconsistency, leading to system misbehavior, crash, or potentially privilege escalation in kernel context.
Recommendation
Update the Linux kernel to a version containing the fix that replaces the SCX_RQ_BAL_KEEP flag with an explicit verdict return from scx_dispatch_sched() and balance_one(). Until then, avoid configurations using sched_ext with core scheduling.
Other vulnerabilities in Linux kernel (sched_ext)
See all- CVE-2026-89516Low risk· EPSS 9%
In the Linux kernel's sched_ext scheduler, scx_bpf_dsq_reenq() queues a deferred reenq (dru) that runs from run_deferred(), not ops.dispatch(). If the DSQ is destroyed before the dru runs, process_deferred_reenq_users() sees dsq->id == SCX_DSQ_INVALID and hits the BUG_ON. destroy_dsq() doesn't flush pending drus, so it should just skip.
- CVE-2025-68333Medium
In the Linux kernel sched_ext subsystem, a possible deadlock exists in deferred_irq_workfn() on PREEMPT_RT=y kernels. When the function runs in the per-CPU irq_work/* task context without interrupts disabled, an interrupt may re-acquire the same rq->__lock. The fix forces the function to always run in hard-irq context.
Original NVD description (English source)
In the Linux kernel, the following vulnerability has been resolved: sched_ext: Replace SCX_RQ_BAL_KEEP with a dispatch verdict return SCX_RQ_BAL_KEEP tells the pick to keep running the previous task, a leftover from when balancing and picking were separate operations. An rq-level flag only works while dispatches and picks pair up one to one, which core scheduling breaks: selections interleave through dispatch's lock drops and a pick can consume a stale flag, keeping a task that has since been dequeued. Fixing core scheduling support requires the decision to travel with the dispatch that made it. Make scx_dispatch_sched() and balance_one() return an explicit verdict instead and drop the flag's plumbing from the tools autogen enum headers. Also factor the pick-side invocation, its follow-up queueing and the post-dispatch checks out of do_pick_task_scx() into dispatch_pick(). No functional changes intended. v2: Drop the SCX_RQ_BAL_KEEP plumbing from the tools autogen enum headers as well (Andrea).
Vulnerability data from NVD (NIST) · CISA KEV · EPSS