This flaw arises in the Linux kernel scheduler: the scheduler’s lock tracking is not updated correctly when a task is moved to a local Device Scheduling Queue (DSQ), causing the lockdep subsystem to assert that a lock is held when it is not. The resulting inconsistent state can trigger a kernel crash or deadlock, effectively leading to a denial of service on the affected host. This issue is a classic example of inadequate synchronization leading to a race condition, and results in loss of availability rather than confidentiality or integrity compromise.

All Linux kernel builds that do not include the update fixing "sched_ext: Preserve rq tracking across local DSQ dispatch" are potentially affected. The exact affected versions are not listed in the CVE data; as such any kernel version prior to the patch that implements the scheduler extension is at risk. The vulnerability is specific to the Linux kernel core component and is not tied to a particular distribution vendor’s patch cycle.

The severity rating is not provided in the CVE, but the presence of a lockdep assertion and the possibility of a kernel panic suggest a high impact if exploited. EPSS data is unavailable, indicating no publicly known exploit data at the time of the advisories. The vulnerability is not listed in CISA’s KEV catalog, which implies no confirmed exploitation has been observed. Likely attack vectors involve locally privileged or BPF-capable code that can manipulate scheduler extensions; an attacker would need the ability to load BPF programs that interact with DSQ scheduling. Even without a published exploit, a local attacker could trigger the bug through crafted BPF or kernel modules and cause a crash, leading to service disruption.