Vulnerability-Lookup

FKIE_CVE-2025-39780

Vulnerability from fkie_nvd - Published: 2025-09-11 17:15 - Updated: 2026-10-19 21:10

Severity

7.8 (High) - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
5.5 (Medium) - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Summary

In the Linux kernel, the following vulnerability has been resolved: sched/ext: Fix invalid task state transitions on class switch When enabling a sched_ext scheduler, we may trigger invalid task state transitions, resulting in warnings like the following (which can be easily reproduced by running the hotplug selftest in a loop): sched_ext: Invalid task state transition 0 -> 3 for fish[770] WARNING: CPU: 18 PID: 787 at kernel/sched/ext.c:3862 scx_set_task_state+0x7c/0xc0 ... RIP: 0010:scx_set_task_state+0x7c/0xc0 ... Call Trace: <TASK> scx_enable_task+0x11f/0x2e0 switching_to_scx+0x24/0x110 scx_enable.isra.0+0xd14/0x13d0 bpf_struct_ops_link_create+0x136/0x1a0 __sys_bpf+0x1edd/0x2c30 __x64_sys_bpf+0x21/0x30 do_syscall_64+0xbb/0x370 entry_SYSCALL_64_after_hwframe+0x77/0x7f This happens because we skip initialization for tasks that are already dead (with their usage counter set to zero), but we don't exclude them during the scheduling class transition phase. Fix this by also skipping dead tasks during class swiching, preventing invalid task state transitions.

References

URL	Tags
416baaa9-dc9f-4396-8d5f-8c081fb06d67	https://git.kernel.org/stable/c/6a32cbe95029ebe21cc08349fd7ef2a3d32d2043	Patch
416baaa9-dc9f-4396-8d5f-8c081fb06d67	https://git.kernel.org/stable/c/786f6314604b34c3e7de5f733f4e08e35c448a50	Patch
416baaa9-dc9f-4396-8d5f-8c081fb06d67	https://git.kernel.org/stable/c/ddf7233fcab6c247379d0928d46cc316ee122229	Patch

Impacted products

Vendor	Product	Version
linux	linux_kernel	*
linux	linux_kernel	*
linux	linux_kernel	6.17
linux	linux_kernel	6.17

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "kernel/sched/ext.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "786f6314604b34c3e7de5f733f4e08e35c448a50",
              "status": "affected",
              "version": "a8532fac7b5d27b8d62008a89593dccb6f9786ef",
              "versionType": "git"
            },
            {
              "lessThan": "6a32cbe95029ebe21cc08349fd7ef2a3d32d2043",
              "status": "affected",
              "version": "a8532fac7b5d27b8d62008a89593dccb6f9786ef",
              "versionType": "git"
            },
            {
              "lessThan": "ddf7233fcab6c247379d0928d46cc316ee122229",
              "status": "affected",
              "version": "a8532fac7b5d27b8d62008a89593dccb6f9786ef",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "kernel/sched/ext.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.12"
            },
            {
              "lessThan": "6.12",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.44",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.16.*",
              "status": "unaffected",
              "version": "6.16.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.17",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "14C4B269-8787-47B5-A04C-8BFCE8F9C2D8",
              "versionEndExcluding": "6.12.44",
              "versionStartIncluding": "6.12",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "AFC28995-B8C3-4B68-8CB6-78E792B6629D",
              "versionEndExcluding": "6.16.4",
              "versionStartIncluding": "6.13",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:6.17:rc1:*:*:*:*:*:*",
              "matchCriteriaId": "327D22EF-390B-454C-BD31-2ED23C998A1C",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:6.17:rc2:*:*:*:*:*:*",
              "matchCriteriaId": "C730CD9A-D969-4A8E-9522-162AAF7C0EE9",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nsched/ext: Fix invalid task state transitions on class switch\n\nWhen enabling a sched_ext scheduler, we may trigger invalid task state\ntransitions, resulting in warnings like the following (which can be\neasily reproduced by running the hotplug selftest in a loop):\n\n sched_ext: Invalid task state transition 0 -\u003e 3 for fish[770]\n WARNING: CPU: 18 PID: 787 at kernel/sched/ext.c:3862 scx_set_task_state+0x7c/0xc0\n ...\n RIP: 0010:scx_set_task_state+0x7c/0xc0\n ...\n Call Trace:\n  \u003cTASK\u003e\n  scx_enable_task+0x11f/0x2e0\n  switching_to_scx+0x24/0x110\n  scx_enable.isra.0+0xd14/0x13d0\n  bpf_struct_ops_link_create+0x136/0x1a0\n  __sys_bpf+0x1edd/0x2c30\n  __x64_sys_bpf+0x21/0x30\n  do_syscall_64+0xbb/0x370\n  entry_SYSCALL_64_after_hwframe+0x77/0x7f\n\nThis happens because we skip initialization for tasks that are already\ndead (with their usage counter set to zero), but we don\u0027t exclude them\nduring the scheduling class transition phase.\n\nFix this by also skipping dead tasks during class swiching, preventing\ninvalid task state transitions."
    },
    {
      "lang": "es",
      "value": "En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nsched/ext: Corrige transiciones de estado de tarea inv\u00e1lidas en el cambio de clase\n\nAl habilitar un planificador sched_ext, podemos desencadenar transiciones de estado de tarea inv\u00e1lidas, lo que resulta en advertencias como las siguientes (que se pueden reproducir f\u00e1cilmente ejecutando la autoprueba de hotplug en un bucle):\n\n sched_ext: Transici\u00f3n de estado de tarea inv\u00e1lida 0 -\u003e 3 para fish[770]\n ADVERTENCIA: CPU: 18 PID: 787 en kernel/sched/ext.c:3862 scx_set_task_state+0x7c/0xc0\n ...\n RIP: 0010:scx_set_task_state+0x7c/0xc0\n ...\n Traza de Llamada:\n  \u003cTAREA\u003e\n  scx_enable_task+0x11f/0x2e0\n  switching_to_scx+0x24/0x110\n  scx_enable.isra.0+0xd14/0x13d0\n  bpf_struct_ops_link_create+0x136/0x1a0\n  __sys_bpf+0x1edd/0x2c30\n  __x64_sys_bpf+0x21/0x30\n  do_syscall_64+0xbb/0x370\n  entry_SYSCALL_64_after_hwframe+0x77/0x7f\n\nEsto sucede porque omitimos la inicializaci\u00f3n para tareas que ya est\u00e1n muertas (con su contador de uso establecido en cero), pero no las excluimos durante la fase de transici\u00f3n de clase de planificaci\u00f3n.\n\nSoluciona esto tambi\u00e9n omitiendo tareas muertas durante el cambio de clase, evitando transiciones de estado de tarea inv\u00e1lidas."
    }
  ],
  "id": "CVE-2025-39780",
  "lastModified": "2026-10-19T21:10:00.160",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "LOCAL",
          "availabilityImpact": "HIGH",
          "baseScore": 7.8,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 1.8,
        "impactScore": 5.9,
        "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "type": "Secondary"
      },
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "LOCAL",
          "availabilityImpact": "HIGH",
          "baseScore": 5.5,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "NONE",
          "integrityImpact": "NONE",
          "privilegesRequired": "LOW",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 1.8,
        "impactScore": 3.6,
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ]
  },
  "published": "2025-09-11T17:15:43.900",
  "references": [
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "tags": [
        "Patch"
      ],
      "url": "https://git.kernel.org/stable/c/6a32cbe95029ebe21cc08349fd7ef2a3d32d2043"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "tags": [
        "Patch"
      ],
      "url": "https://git.kernel.org/stable/c/786f6314604b34c3e7de5f733f4e08e35c448a50"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "tags": [
        "Patch"
      ],
      "url": "https://git.kernel.org/stable/c/ddf7233fcab6c247379d0928d46cc316ee122229"
    }
  ],
  "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "NVD-CWE-noinfo"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}

CVE-2025-39780 (GCVE-0-2025-39780)

Vulnerability from cvelistv5 – Published: 2025-09-11 16:56 – Updated: 2026-08-05 12:05

Title

sched/ext: Fix invalid task state transitions on class switch

Summary

Severity

7.8 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Assigner

Linux CNA under the mitre root

CNA scorecard D 53/100 over 7018 records in the last 180 days details

References

3 references

URL	Tags
https://git.kernel.org/stable/c/786f6314604b34c3e…
https://git.kernel.org/stable/c/6a32cbe95029ebe21…
https://git.kernel.org/stable/c/ddf7233fcab6c2473…

Impacted products

2 products

Vendor	Product	Version
Linux	Linux	Affected: a8532fac7b5d27b8d62008a89593dccb6f9786ef , < 786f6314604b34c3e7de5f733f4e08e35c448a50 (git) Affected: a8532fac7b5d27b8d62008a89593dccb6f9786ef , < 6a32cbe95029ebe21cc08349fd7ef2a3d32d2043 (git) Affected: a8532fac7b5d27b8d62008a89593dccb6f9786ef , < ddf7233fcab6c247379d0928d46cc316ee122229 (git)
Linux	Linux	Affected: 6.12 Unaffected: 0 , < 6.12 (semver) Unaffected: 6.12.44 , ≤ 6.12.* (semver) Unaffected: 6.16.4 , ≤ 6.16.* (semver) Unaffected: 6.17 , ≤ * (original_commit_for_fix)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "kernel/sched/ext.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "786f6314604b34c3e7de5f733f4e08e35c448a50",
              "status": "affected",
              "version": "a8532fac7b5d27b8d62008a89593dccb6f9786ef",
              "versionType": "git"
            },
            {
              "lessThan": "6a32cbe95029ebe21cc08349fd7ef2a3d32d2043",
              "status": "affected",
              "version": "a8532fac7b5d27b8d62008a89593dccb6f9786ef",
              "versionType": "git"
            },
            {
              "lessThan": "ddf7233fcab6c247379d0928d46cc316ee122229",
              "status": "affected",
              "version": "a8532fac7b5d27b8d62008a89593dccb6f9786ef",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "kernel/sched/ext.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.12"
            },
            {
              "lessThan": "6.12",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.44",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.16.*",
              "status": "unaffected",
              "version": "6.16.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.17",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.44",
                  "versionStartIncluding": "6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.16.4",
                  "versionStartIncluding": "6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.17",
                  "versionStartIncluding": "6.12",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nsched/ext: Fix invalid task state transitions on class switch\n\nWhen enabling a sched_ext scheduler, we may trigger invalid task state\ntransitions, resulting in warnings like the following (which can be\neasily reproduced by running the hotplug selftest in a loop):\n\n sched_ext: Invalid task state transition 0 -\u003e 3 for fish[770]\n WARNING: CPU: 18 PID: 787 at kernel/sched/ext.c:3862 scx_set_task_state+0x7c/0xc0\n ...\n RIP: 0010:scx_set_task_state+0x7c/0xc0\n ...\n Call Trace:\n  \u003cTASK\u003e\n  scx_enable_task+0x11f/0x2e0\n  switching_to_scx+0x24/0x110\n  scx_enable.isra.0+0xd14/0x13d0\n  bpf_struct_ops_link_create+0x136/0x1a0\n  __sys_bpf+0x1edd/0x2c30\n  __x64_sys_bpf+0x21/0x30\n  do_syscall_64+0xbb/0x370\n  entry_SYSCALL_64_after_hwframe+0x77/0x7f\n\nThis happens because we skip initialization for tasks that are already\ndead (with their usage counter set to zero), but we don\u0027t exclude them\nduring the scheduling class transition phase.\n\nFix this by also skipping dead tasks during class swiching, preventing\ninvalid task state transitions."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerable path is entered through the local `bpf(BPF_LINK_CREATE)` syscall attaching a sched_ext struct_ops scheduler, combined with local task fork/exit churn to populate the race window. No network-reachable code is involved.\nAC:L - The attacker controls both sides of the race \u2014 generating a storm of exiting tasks (each of which sits on `scx_tasks` with `usage == 0` for a full RCU grace period, since `put_task_struct()` always defers via `call_rcu()`) while repeatedly enabling a scheduler; upstream states it is \"easily reproduced by running the hotplug selftest in a loop\".\nPR:L - Enabling a sched_ext scheduler needs only `bpf_token_capable(CAP_BPF)`, which is delegable to unprivileged users in user namespaces via BPF tokens (and is open on `unprivileged_bpf_disabled=0` systems); on deployments where a daemon such as scx_loader switches schedulers, a wholly unprivileged user supplies the dying-task half of the race.\nUI:N - The entire sequence \u2014 scheduler attach plus fork/exit churn \u2014 is driven by the attacker\u0027s own processes. No victim action is required.\nS:U - The corruption is confined to kernel scheduler state within the same security authority; no VM, IOMMU, or sandbox boundary is crossed.\nC:H - The code reads and writes a `task_struct` whose usage refcount has already reached zero and which is queued for RCU-deferred destruction \u2014 the exact condition the `Fixes:` commit identifies as a use-after-free hazard \u2014 and drives BPF `ops.enable()`/`ops.exit_task()` against a task with no allocated per-task context, exposing stale/foreign scheduler state.\nI:H - `p-\u003esched_class` (a pointer to the scheduling-class function-pointer dispatch table), `p-\u003escx.slice`, and `p-\u003escx.flags` are written into an object that is mid-teardown and pending free, and the sched_ext task state machine is forced through an illegal `NONE -\u003e ENABLED` transition that corrupts BPF-scheduler per-task accounting.\nA:H - The bug triggers a `WARN_ONCE()` splat in `scx_set_task_state()`, which is an immediate kernel panic on the many hardened, cloud, Android, and CI configurations that set `panic_on_warn`; additionally the resulting contract violation makes real BPF schedulers call `scx_bpf_error()`, ejecting the scheduler and disrupting scheduling system-wide."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:05:05.360Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/786f6314604b34c3e7de5f733f4e08e35c448a50"
        },
        {
          "url": "https://git.kernel.org/stable/c/6a32cbe95029ebe21cc08349fd7ef2a3d32d2043"
        },
        {
          "url": "https://git.kernel.org/stable/c/ddf7233fcab6c247379d0928d46cc316ee122229"
        }
      ],
      "title": "sched/ext: Fix invalid task state transitions on class switch",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-39780",
    "datePublished": "2025-09-11T16:56:31.142Z",
    "dateReserved": "2025-04-16T07:20:57.130Z",
    "dateUpdated": "2026-08-05T12:05:05.360Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

Order JSON

Publication & reservation Sightings KEV catalogs Other timestamps

Loading timeline…

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted