Vulnerability-Lookup

FKIE_CVE-2026-89521

Vulnerability from fkie_nvd - Published: 2026-09-11 20:19 - Updated: 2026-10-19 09:17

Severity

7.3 (High) - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:H

Summary

In the Linux kernel, the following vulnerability has been resolved: sched/core: Handle pick_task() releasing the rq lock Core scheduling's pick_next_task() breaks when a ->pick_task() implementation can release the rq lock. The selection state derived on entry is only valid while the lock is held continuously. Once a pick can drop the lock, an interleaving selection can invalidate all of it: the single-CPU fast path can commit an uncookied pick although the core went cookied during the release, and forceidle committed by the interleaving selection skews the restarted pass's accounting. Fix it by restarting the whole selection when a pick returns RETRY_TASK after releasing the lock: a single restart point above the state derivation replaces the per-loop restart labels, so a retry picks up state committed by interleaving selections and accounts and resets forceidle like a fresh selection would. need_sync and fi_before latch across retries. Clock validity can't be re-derived - there is no program-ordered way to tell whether the own and core rq clocks are still updated after the lock was released, as other lockers' pin cycles may or may not have invalidated them. When restarting, clear core_clock_updated so that the sibling loop re-updates the core rq, and update the own rq clock if invalidated.

References

	URL	Tags
	416baaa9-dc9f-4396-8d5f-8c081fb06d67	https://git.kernel.org/stable/c/88ed5a66467ca2a5148b9997af9c71d8c43060ad
	416baaa9-dc9f-4396-8d5f-8c081fb06d67	https://git.kernel.org/stable/c/c10b216a072ff5c57bc880a05f87eb519aecc529

Impacted products

	Vendor	Product	Version

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "kernel/sched/core.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "88ed5a66467ca2a5148b9997af9c71d8c43060ad",
              "status": "affected",
              "version": "4c95380701f58b8112f0b891de8d160e4199e19d",
              "versionType": "git"
            },
            {
              "lessThan": "c10b216a072ff5c57bc880a05f87eb519aecc529",
              "status": "affected",
              "version": "4c95380701f58b8112f0b891de8d160e4199e19d",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "kernel/sched/core.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.19"
            },
            {
              "lessThan": "6.19",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.3",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nsched/core: Handle pick_task() releasing the rq lock\n\nCore scheduling\u0027s pick_next_task() breaks when a -\u003epick_task()\nimplementation can release the rq lock. The selection state derived on entry\nis only valid while the lock is held continuously. Once a pick can drop the\nlock, an interleaving selection can invalidate all of it: the single-CPU\nfast path can commit an uncookied pick although the core went cookied during\nthe release, and forceidle committed by the interleaving selection skews the\nrestarted pass\u0027s accounting.\n\nFix it by restarting the whole selection when a pick returns RETRY_TASK\nafter releasing the lock: a single restart point above the state derivation\nreplaces the per-loop restart labels, so a retry picks up state committed by\ninterleaving selections and accounts and resets forceidle like a fresh\nselection would.\n\nneed_sync and fi_before latch across retries. Clock validity can\u0027t be\nre-derived - there is no program-ordered way to tell whether the own and\ncore rq clocks are still updated after the lock was released, as other\nlockers\u0027 pin cycles may or may not have invalidated them. When restarting,\nclear core_clock_updated so that the sibling loop re-updates the core rq,\nand update the own rq clock if invalidated."
    }
  ],
  "id": "CVE-2026-89521",
  "lastModified": "2026-10-19T09:17:46.537",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "LOCAL",
          "availabilityImpact": "HIGH",
          "baseScore": 7.3,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "LOW",
          "privilegesRequired": "LOW",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 1.8,
        "impactScore": 5.5,
        "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "type": "Secondary"
      }
    ]
  },
  "published": "2026-09-11T20:19:34.767",
  "references": [
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/88ed5a66467ca2a5148b9997af9c71d8c43060ad"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/c10b216a072ff5c57bc880a05f87eb519aecc529"
    }
  ],
  "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
  "vulnStatus": "Received"
}

CVE-2026-89521 (GCVE-0-2026-89521)

Vulnerability from cvelistv5 – Published: 2026-09-11 19:44 – Updated: 2026-10-19 08:48

Title

sched/core: Handle pick_task() releasing the rq lock

Summary

Severity

7.3 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:H

Assigner

Linux CNA under the mitre root

CNA scorecard D 53/100 over 6639 records in the last 180 days details

References

2 references

URL	Tags
https://git.kernel.org/stable/c/88ed5a66467ca2a51…
https://git.kernel.org/stable/c/c10b216a072ff5c57…

Impacted products

2 products

Vendor	Product	Version
Linux	Linux	Affected: 4c95380701f58b8112f0b891de8d160e4199e19d , < 88ed5a66467ca2a5148b9997af9c71d8c43060ad (git) Affected: 4c95380701f58b8112f0b891de8d160e4199e19d , < c10b216a072ff5c57bc880a05f87eb519aecc529 (git)
Linux	Linux	Affected: 6.19 Unaffected: 0 , < 6.19 (semver) Unaffected: 7.2.4 , ≤ 7.2.* (semver) Unaffected: 7.3 , ≤ * (original_commit_for_fix)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "kernel/sched/core.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "88ed5a66467ca2a5148b9997af9c71d8c43060ad",
              "status": "affected",
              "version": "4c95380701f58b8112f0b891de8d160e4199e19d",
              "versionType": "git"
            },
            {
              "lessThan": "c10b216a072ff5c57bc880a05f87eb519aecc529",
              "status": "affected",
              "version": "4c95380701f58b8112f0b891de8d160e4199e19d",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "kernel/sched/core.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.19"
            },
            {
              "lessThan": "6.19",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.3",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2.4",
                  "versionStartIncluding": "6.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.3",
                  "versionStartIncluding": "6.19",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nsched/core: Handle pick_task() releasing the rq lock\n\nCore scheduling\u0027s pick_next_task() breaks when a -\u003epick_task()\nimplementation can release the rq lock. The selection state derived on entry\nis only valid while the lock is held continuously. Once a pick can drop the\nlock, an interleaving selection can invalidate all of it: the single-CPU\nfast path can commit an uncookied pick although the core went cookied during\nthe release, and forceidle committed by the interleaving selection skews the\nrestarted pass\u0027s accounting.\n\nFix it by restarting the whole selection when a pick returns RETRY_TASK\nafter releasing the lock: a single restart point above the state derivation\nreplaces the per-loop restart labels, so a retry picks up state committed by\ninterleaving selections and accounts and resets forceidle like a fresh\nselection would.\n\nneed_sync and fi_before latch across retries. Clock validity can\u0027t be\nre-derived - there is no program-ordered way to tell whether the own and\ncore rq clocks are still updated after the lock was released, as other\nlockers\u0027 pin cycles may or may not have invalidated them. When restarting,\nclear core_clock_updated so that the sibling loop re-updates the core rq,\nand update the own rq clock if invalidated."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.3,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The flaw is in pick_next_task() in kernel/sched/core.c, reached only from the local __schedule() hotpath. An attacker triggers it with prctl(PR_SCHED_CORE) and their own threads; it is not reachable from network packet processing, ksmbd/nfsd, or other remote handlers.\nAC:L - The attacker controls both sides of the race: they create cookied and uncookied tasks, pin them on both SMT siblings, and generate concurrent scheduling so pick_task_scx() drops the rq lock during core-wide selection. Success does not depend on an uncontrollable victim state or memory layout.\nPR:L - prctl(PR_SCHED_CORE) is available to an unprivileged process (only ptrace_may_access on its own tasks). The lock-dropping pick_task() is sched_ext, which an attacker can load with CAP_BPF/CAP_PERFMON via a user namespace or BPF token, or which may already be loaded on the host.\nUI:N - The attacker enables core scheduling, runs their own threads on SMT siblings, and drives context switches themselves. No victim action such as mounting a filesystem or opening a file is required.\nS:U - Impact is confined to the host kernel scheduler (SMT cookie selection and forceidle/vruntime accounting). This is a same-host isolation failure, not a VM/guest-to-host escape or IOMMU/DMA boundary bypass.\nC:H - After pick_task() drops the rq lock, the single-CPU fast path can commit an uncookied pick while an interleaving selection made the core cookied, so SMT siblings run mismatched cookies and bypass core scheduling\u0027s L1TF/MDS isolation, enabling cross-domain memory disclosure via SMT side channels.\nI:L - The misplaced RETRY_TASK restart skips forceidle reset and can apply invalidated rq clocks to vruntime and forceidle accounting, which is limited corruption of scheduler metadata rather than an arbitrary kernel write or control-flow hijack.\nA:H - Invalidated rq clocks and skewed forceidle accounting after a lock-dropping pick can apply a huge bogus vruntime delta or incorrectly force-idle SMT siblings, stranding runnable tasks in a hang-class scheduling DoS on the core."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-19T08:48:12.536Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/88ed5a66467ca2a5148b9997af9c71d8c43060ad"
        },
        {
          "url": "https://git.kernel.org/stable/c/c10b216a072ff5c57bc880a05f87eb519aecc529"
        }
      ],
      "title": "sched/core: Handle pick_task() releasing the rq lock",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-89521",
    "datePublished": "2026-09-11T19:44:03.257Z",
    "dateReserved": "2026-09-11T19:38:34.718Z",
    "dateUpdated": "2026-10-19T08:48:12.536Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

Order JSON

How durations are calculated

Following the VTEM framework (Black Hat USA 2015), time to patch starts when the vendor or a coordinator was informed, total time to patch at discovery, and disclosure to patch at public disclosure; vendor response time runs from the report to its acknowledgement. Time to exploit and time unpatched start at the earliest discovery or report, falling back to public disclosure. Unpatched time ends at the first recorded patch, or the calculation time when no patch is recorded. Exploitation to patch shows the interval between those two events; a published proof of concept is a public exploit, not exploitation.

Each result shows its source dates. A negative interval means the end event came first; when date-only inputs leave the order open, the result says so. Date-only inputs are approximate. The earliest evidence wins: KEV report dates and sightings are labelled as such. Records describing another vulnerability are listed but never calculated from, and a PoC alone does not establish exploitation. Missing patch evidence does not prove that no patch exists. Filters below change the event list only.

Publication & reservation Sightings KEV catalogs Other timestamps

Loading timeline…

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted