Linux kernel sched_ext: a failed sub-scheduler enable races root disable into a use-after-free

Impact

A sub-scheduler enable can fail before scx_link_sched() puts it in the hierarchy, yet cleanup still runs the full scx_sub_disable() path. An unlinked sub is invisible to drain_descendants(), which is the only ordering against root disable, so root teardown can exit every task to no scheduler between the sub's drain and its task walk; the walk then trips the membership WARN and re-homes exited tasks onto the dying hierarchy - a use-after-free. This only affects fleets that run BPF schedulers, which some operators do adopt on GPU nodes to tune data-loader and rank latency; on those, the failure mode is a kernel-side crash of the node's scheduling.

Who can reach it

Local root or CAP_SYS_ADMIN able to attach sched_ext schedulers, and specifically to a hierarchy with sub-schedulers where an enable fails while the root is being disabled. Not reachable by tenant workloads. Nodes with no scx scheduler loaded have no exposure.

What to do

Update to a stable kernel with the fix and reboot the node. Until then, the cheap interim is to avoid nested sub-scheduler hierarchies and to not tear down the root scheduler while sub-scheduler enables are in flight; unloading scx entirely removes the path if the latency tuning can wait.

References

Related entries

• Microsoft Hyper-V: vmswitch fails to validate guest OID requestsCVE-2021-28476 · Microsoft Hyper-VCritical
• Incus: instance snapshots bypass restricted.containers.lowlevel, giving command execution on the hostCVE-2026-48751 · Incus (instance snapshots ignore restricted.containers.lowlevel)Critical
• VMware ESXi (OpenSLP): Use-after-free in OpenSLP on port 427 - unauthenticated remote code execution on the hypervisorCVE-2020-3992 · VMware ESXi (OpenSLP)Critical
• Linux kernel mlx5_core kTLS RX offload: TLS RX resync list corruption: entries are moved by the resync handlerCVE-2021-47215 · Linux kernel mlx5_core kTLS RX offloadCritical
• Linux kernel (drivers/nvme/host): The NVMe/RDMA initiator destroys the queue pair before the connection manager ID, soCVE-2021-47378 · Linux kernel (drivers/nvme/host)Critical
• Linux kernel (net/tls): KTLS stored a negative errno into the socket error field where a positive value is expected. ACVE-2021-47496 · Linux kernel (net/tls)Critical