The vulnerability causes the Linux kernel to emit an unnecessary WARN message when the sched_ext scheduler handles a NULL cgrp_moving_from pointer during scx_cgroup_move_task(). This represents a CWE-476 (NULL Pointer Dereference) weakness, yet the code path guards against dereferencing, so the system continues to operate normally; the warning does not result in crashes, data corruption, or privilege escalation.

All installations of the Linux kernel that include the sched_ext scheduler and have not yet incorporated the upstream commit that silences the warning are affected. This includes current mainline kernels and any distribution kernels that have opted to keep sched_ext and have not applied the patch.

The EPSS score is less than listed in CISA’s KEV catalog, showing a very low likelihood of exploitation. Based on the description, it is inferred that an attacker would need privileged access to manipulate cgroup settings, which would only trigger harmless log entries without any tangible benefit. The likely attack vector is local privileged manipulation of cgroup configurations; no known exploitation path exists beyond generating noise in the kernel log.