Linux kernel sched_ext: lock inversion between scx_cgroup_lock and cgroup_mutex deadlocks the node

Impact

scx_cgroup_lock() write-locks scx_cgroup_ops_rwsem before taking cgroup_lock(), which inverts the order used elsewhere and closes a three-way cycle through kernfs: an scx enable/disable waits on cgroup_mutex, a cgroup rmdir waits in kernfs_drain() for an active reference, and a cpu.weight write waits behind the pending rwsem writer. Nothing breaks the cycle. On a Kubernetes GPU node the second and third participants are routine background activity - pod teardown and CPU-share updates from the runtime - so loading or unloading a sched_ext scheduler on a busy node can wedge tasks permanently. Recovery is a reboot, and a GPU node in the middle of a training job is expensive to take out that way.

Who can reach it

Local and privileged: enabling or disabling a sched_ext scheduler requires root on the host. The colliding operations (cgroup removal, cpu.weight writes) come from the container runtime, not from a tenant. Treat this as an operational availability bug on hosts that run sched_ext, not as a tenant-reachable attack.

What to do

Install the patched kernel from the linked stable commits, which take cgroup_lock() first, and reboot each node. Until then the practical mitigation is to avoid enabling or swapping sched_ext schedulers on nodes with live cgroup churn; hosts that never load an scx scheduler do not hit the path.

References

Related entries

• Linux kernel PSI: rtpoll timer can outlive its cgroup and fire on freed memoryCVE-2026-74594 · Linux kernel sched/psi (rtpoll_timer lifetime vs psi_cgroup_free)Unscored
• Linux kernel page_table_check: unprivileged zero mappings overflow the file map counter and panic the hostCVE-2026-74600 · Linux kernel mm/page_table_check (zero-page and huge-zero PMD accounting)Unscored
• KVM SVM SEV: races between encryption-context move and copy corrupt the mirror list and misdirect a VM referenceCVE-2026-74607 · KVM SVM SEV (owner/mirror VM list serialisation across MOVE_ENC_CONTEXT_FROM and COPY_ENC_CONTEXT_FROM)Unscored
• Linux kernel perf/core: use-after-free on a freed group leader after a sibling is detached during CPU hotplugCVE-2026-74637 · Linux kernel perf/core (perf_group_detach sibling promotion)Unscored
• Linux kernel IMA: integer underflow in xattr_verify() causes out-of-bounds read on truncated security.imaCVE-2026-74671 · Linux kernel IMA (xattr_verify digest-length check)Unscored
• Linux kernel mm/vmalloc: use-after-free when vmap huge-page promotion frees a page table under a concurrent ptdump walkCVE-2026-74672 · Linux kernel mm/vmalloc (huge vmap promotion vs ptdump page-table walk)Unscored