A flaw in the Linux kernel’s deadline scheduler causes the REPLENISH flag to be omitted when a SCHED_DEADLINE task that holds a PI mutex is demoted to a lower priority class via sched_setscheduler. The resulting bandwidth accounting corruption can lead to inaccurate CPU slice allocation, task starvation, and potential system instability. This weakness is classified as CWE-372, indicating incorrect manipulation of a calculation.

All Linux kernel releases that include the classic deadline scheduler before the patch commit are affected. The issue manifests when a DEADLINE task holds a PI mutex and is later demoted while still holding that mutex, so any distribution of Linux kernel with scheduling support can be impacted until the described fix is applied.

The CVSS score is not provided, but the EPSS probability is below 1% and the vulnerability is not listed in the CISA KEV catalog, suggesting a low likelihood of widespread exploitation. An attacker would need local privileged access to create a DEADLINE task and manipulate its scheduling class while holding a PI mutex. The risk is therefore considered low to moderate, but the potential impact on system performance warrants prompt attention.