The Linux kernel’s scx_enable() routine changes a thread’s scheduling class from fair to ext while it attempts to enable extended‑class (scx) functionality. This vulnerability reflects the weakness type CWE‑821, a resource lock during computation that can result in starvation. Because fair scheduling has a higher priority than ext, workloads that saturate fair‑class tasks can starve the enable thread, causing the system to hang. This issue was introduced when the code was switched from preempt_disable() to scx_bypass(), which does not guard against such starvation. The patch solves the problem by offloading the enable work to a dedicated system‑wide real‑time (SCHED_FIFO) kernel thread that cannot be starved by either class. The vulnerability can lead to a permanent system halt until a reboot.

All Linux kernel builds that contain the unpatched scx_enable() logic are affected, regardless of distribution or architecture. The available kernel version data indicates that all released 6.12 release candidates, 7.0 release candidates, and the generic Linux kernel are susceptible. Any system running a kernel before the commit that introduced the dedicated real‑time thread for scx_enable() is potentially vulnerable.

The CVSS v3.1 score is 5.5, reflecting a moderate severity that results in denial of service. The EPSS score of less than 1% indicates a very low but nonzero likelihood that the vulnerability will be actively exploited. It is not listed in CISA’s KEV catalog, so no widespread exploitation records are known. The attack vector likely requires the attacker to saturate fair‑class workloads, for example by launching an excessive number of high‑priority tasks; this is inferred from the description and is not explicitly documented as a proven exploitation method in the CVE record.