Linux kernel sched/core: core-scheduling selection corrupted by lock-dropping picks and concurrent flips

Impact

The core-scheduling side of the same problem, in generic sched/core rather than in sched_ext. A ->pick_task() that releases the rq lock leaves every sibling __lock momentarily free, so __sched_core_flip(false) can complete mid-selection and rebind rq_lockp() underneath it: the selection then touches sibling state it no longer protects, and __schedule() releases a lock it never took while leaking the one it did. Separately, the single-CPU fast path can commit an uncookied pick even though the core went cookied during the release, and forceidle accounting is skewed by an interleaving pass. The fixes count in-flight selections in the leader's rq->core_pick_in_flight so flips wait for them to drain, and restart the whole selection when a pick returns RETRY_TASK. The vendor split this across two ids (CVE-2026-89521); one flaw, one remediation. Consequence on a GPU node is rq-lock imbalance and hard hangs - every job on the node goes with it.

Who can reach it

Local, on nodes with core scheduling enabled together with a scheduling class whose pick can drop the rq lock (in practice sched_ext). Enabling core scheduling and loading the scheduler takes root; after that, cookie lifetime events and normal scheduling hit the race.

What to do

Take the stable kernel update carrying both changes - the flip waits for in-flight core-wide selections, and the selection restarts above its state derivation on RETRY_TASK - and reboot each node. Interim option: disable core scheduling on affected nodes, or run without a lock-dropping scheduling class. The record gives commits only, no fixed release numbers.

Also covers 1 CVE

The vendor assigned a separate id to each affected code path. They share this advisory, this score and this fix, so they are one entry here.

References

Related entries

• Linux kernel SUNRPC: use-after-free of the lower transport when a TLS handshake cancel races completionCVE-2026-89536 · Linux kernel SUNRPC (client-side TLS handshake, xs_tls_handshake_sync)Unscored
• Linux kernel SUNRPC: short Kerberos MIC tokens read past a slab allocation on the RPC client and serverCVE-2026-89537 · Linux kernel SUNRPC GSS-Kerberos (gss_krb5_verify_mic_v2 token length check)Unscored
• Linux kernel SUNRPC: oversized krb5 wrap-token ec field leaves the receive xdr_buf in an inconsistent stateCVE-2026-89538 · Linux kernel SUNRPC GSS-Kerberos (gss_krb5_unwrap_v2, extra-count field)Unscored
• Linux kernel SUNRPC: integer overflow in krb5p reply length check lets a hostile NFS server drive OOB readsCVE-2026-89541 · Linux kernel SUNRPC (gss_unwrap_resp_priv RPCSEC_GSS opaque length check)Unscored
• Linux kernel SUNRPC: short krb5 wrap tokens cause OOB reads, a divide-by-zero and a huge memmoveCVE-2026-89542 · Linux kernel SUNRPC GSS-Kerberos (gss_krb5_unwrap_v2 and rotate_left short-token handling)Unscored
• Linux kernel SUNRPC: stale pipefs_sb pointer leaves dentries referencing a freed rpc_clntCVE-2026-89543 · Linux kernel SUNRPC (rpc_clnt pipefs superblock tracking)Unscored