Linux kernel (sched_ext) vulnerabilities

In the Linux kernel's sched_ext scheduler, the SCX_RQ_BAL_KEEP flag tells the pick to keep running the previous task, a leftover from when balancing and picking were separate operations. An rq-level flag only works while dispatches and picks pair up one to one, which core scheduling breaks: selections interleave through dispatch's lock drops and a pick can consume a stale flag, keeping a task that has since been dequeued.

In the Linux kernel's sched_ext scheduler, scx_bpf_dsq_reenq() queues a deferred reenq (dru) that runs from run_deferred(), not ops.dispatch(). If the DSQ is destroyed before the dru runs, process_deferred_reenq_users() sees dsq->id == SCX_DSQ_INVALID and hits the BUG_ON. destroy_dsq() doesn't flush pending drus, so it should just skip.

In the Linux kernel sched_ext subsystem, a possible deadlock exists in deferred_irq_workfn() on PREEMPT_RT=y kernels. When the function runs in the per-CPU irq_work/* task context without interrupts disabled, an interrupt may re-acquire the same rq->__lock. The fix forces the function to always run in hard-irq context.