Linux kernel sched_ext: core-scheduling pick state corrupted when dispatch drops the rq lock

Impact

Core scheduling picks a task for every SMT sibling in one pass under the core-wide rq lock, and that state is only valid while the lock is held continuously. Since sched_ext folded dispatch into the pick, dispatch can drop the lock, so two selections on the same core interleave and clobber each other: one clears the other's rq->core_pick (NULL dereference) or invalidates its keep-the-previous-task decision, leaving a dequeued task running and deadlocking the next wakeup. The report is blunt about the severity - a cookied ping-pong load on an SMT machine kills the kernel within seconds. This matters where core scheduling is used deliberately, which is exactly the multi-tenant case: operators enable cookies to stop tenants sharing a physical core. The vendor split this across two ids (CVE-2026-89519 removes the rq-level SCX_RQ_BAL_KEEP flag so the decision travels with the dispatch that made it, which is what makes the fix possible); they are one flaw with one remediation.

Who can reach it

Local, and only on nodes that run a sched_ext BPF scheduler with core scheduling enabled. Loading the scheduler and setting core-sched cookies takes root, but once that configuration is live an ordinary cookied workload triggers the hangs, so a tenant's normal job can bring the node down.

What to do

Update to a kernel containing both changes - the pick returns RETRY_TASK whenever dispatch released the rq lock, and the keep decision becomes an explicit dispatch verdict - and reboot each node. If you cannot reboot yet, either disable core scheduling or unload the sched_ext scheduler on affected nodes; either one removes the interleaving. The record gives commits, not fixed release numbers.

Also covers 1 CVE

The vendor assigned a separate id to each affected code path. They share this advisory, this score and this fix, so they are one entry here.

References

Related entries

• Linux kernel sched_ext: deadlock and NULL deref when dispatch kfuncs assume the local rqCVE-2026-89518 · Linux kernel sched_ext dispatch kfuncs (this_rq() vs the dispatched rq under core scheduling)Unscored
• Linux kernel sched/core: core-scheduling selection corrupted by lock-dropping picks and concurrent flipsCVE-2026-89520 · Linux kernel sched/core (core-scheduling selection vs a pick_task() that releases the rq lock)Unscored
• Linux kernel SUNRPC: use-after-free of the lower transport when a TLS handshake cancel races completionCVE-2026-89536 · Linux kernel SUNRPC (client-side TLS handshake, xs_tls_handshake_sync)Unscored
• Linux kernel SUNRPC: short Kerberos MIC tokens read past a slab allocation on the RPC client and serverCVE-2026-89537 · Linux kernel SUNRPC GSS-Kerberos (gss_krb5_verify_mic_v2 token length check)Unscored
• Linux kernel SUNRPC: oversized krb5 wrap-token ec field leaves the receive xdr_buf in an inconsistent stateCVE-2026-89538 · Linux kernel SUNRPC GSS-Kerberos (gss_krb5_unwrap_v2, extra-count field)Unscored
• Linux kernel SUNRPC: integer overflow in krb5p reply length check lets a hostile NFS server drive OOB readsCVE-2026-89541 · Linux kernel SUNRPC (gss_unwrap_resp_priv RPCSEC_GSS opaque length check)Unscored