Description
In the Linux kernel, the following vulnerability has been resolved:

sched_ext: Fix starvation of scx_enable() under fair-class saturation

During scx_enable(), the READY -> ENABLED task switching loop changes the
calling thread's sched_class from fair to ext. Since fair has higher
priority than ext, saturating fair-class workloads can indefinitely starve
the enable thread, hanging the system. This was introduced when the enable
path switched from preempt_disable() to scx_bypass() which doesn't protect
against fair-class starvation. Note that the original preempt_disable()
protection wasn't complete either - in partial switch modes, the calling
thread could still be starved after preempt_enable() as it may have been
switched to ext class.

Fix it by offloading the enable body to a dedicated system-wide RT
(SCHED_FIFO) kthread which cannot be starved by either fair or ext class
tasks. scx_enable() lazily creates the kthread on first use and passes the
ops pointer through a struct scx_enable_cmd containing the kthread_work,
then synchronously waits for completion.

The workfn runs on a different kthread from sch->helper (which runs
disable_work), so it can safely flush disable_work on the error path
without deadlock.
Published: 2026-05-08
Score: n/a
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

During the execution of scx_enable() in the Linux kernel, the thread's scheduling class is switched from the fair class to the ext class. Because the fair class has a higher scheduling priority, workloads that saturate fair-class tasks can prevent the enable thread from running, causing the system to hang indefinitely. The issue arose when the protection mechanism changed from preempt_disable() to scx_bypass(), which does not guard against this starvation. The fix moves the enable work to a dedicated real-time (SCHED_FIFO) kernel thread that cannot be starved by either fair or ext class tasks, eliminating the deadlock path.

Affected Systems

All Linux kernel implementations that contain the unpatched scx_enable() logic are affected, regardless of distribution. Both the default scheduler and any extended (sched_ext) implementations that rely on scx_enable() may experience the starvation problem. The vulnerability does not specify a particular kernel release, so any kernel built before the patch commit is potentially vulnerable.

Risk and Exploitability

The CVSS score is not disclosed in the available data, and no EPSS value is provided, indicating that the exploitation likelihood has not been quantified. The vulnerability is not listed in CISA's KEV catalog, suggesting no known widespread exploitation at this time. The prerequisite for exploitation is the saturation of fair-class workloads, which may be engineered or opportunistic; therefore, the exploitation difficulty could be low to moderate in environments with high fair-class load, but the impact of a single successful event is severe, leading to a permanent system halt until reboot.

Generated by OpenCVE AI on May 9, 2026 at 03:52 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply the kernel patch that implements the change in scx_enable(), for example by installing a kernel build that includes commit 05ab9ec5dc24f234e0a2fecf3e6ff937c68f7d81 or a downstream backport of the fix.
  • Reboot the system so that the updated kernel image and scheduler code are loaded.
  • As a temporary mitigation, limit the number or priority of high-priority fair-class tasks or apply cgroup limits to reduce the likelihood of fair-class saturation until the patch can be applied.

Generated by OpenCVE AI on May 9, 2026 at 03:52 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Sat, 09 May 2026 02:45:00 +0000

Type Values Removed Values Added
Weaknesses CWE-399
CWE-400

Sat, 09 May 2026 00:15:00 +0000


Fri, 08 May 2026 18:45:00 +0000

Type Values Removed Values Added
Weaknesses CWE-399
CWE-400

Fri, 08 May 2026 14:45:00 +0000

Type Values Removed Values Added
Description In the Linux kernel, the following vulnerability has been resolved: sched_ext: Fix starvation of scx_enable() under fair-class saturation During scx_enable(), the READY -> ENABLED task switching loop changes the calling thread's sched_class from fair to ext. Since fair has higher priority than ext, saturating fair-class workloads can indefinitely starve the enable thread, hanging the system. This was introduced when the enable path switched from preempt_disable() to scx_bypass() which doesn't protect against fair-class starvation. Note that the original preempt_disable() protection wasn't complete either - in partial switch modes, the calling thread could still be starved after preempt_enable() as it may have been switched to ext class. Fix it by offloading the enable body to a dedicated system-wide RT (SCHED_FIFO) kthread which cannot be starved by either fair or ext class tasks. scx_enable() lazily creates the kthread on first use and passes the ops pointer through a struct scx_enable_cmd containing the kthread_work, then synchronously waits for completion. The workfn runs on a different kthread from sch->helper (which runs disable_work), so it can safely flush disable_work on the error path without deadlock.
Title sched_ext: Fix starvation of scx_enable() under fair-class saturation
First Time appeared Linux
Linux linux Kernel
CPEs cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Vendors & Products Linux
Linux linux Kernel
References

Subscriptions

Linux Linux Kernel
cve-icon MITRE

Status: PUBLISHED

Assigner: Linux

Published:

Updated: 2026-05-08T14:21:36.692Z

Reserved: 2026-05-01T14:12:56.007Z

Link: CVE-2026-43392

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-05-08T15:16:50.583

Modified: 2026-05-08T15:16:50.583

Link: CVE-2026-43392

cve-icon Redhat

Severity :

Publid Date: 2026-05-08T00:00:00Z

Links: CVE-2026-43392 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-05-09T04:00:14Z

Weaknesses