This vulnerability is a lock ordering flaw in the Linux kernel’s sched_ext module. The function scx_cgroup_lock() previously acquired a read‑write semaphore before calling cgroup_lock(), creating a circular dependency that can lead to a deadlock when cgroup-controlled operations and cpu weight modifications are performed concurrently. The resulting deadlock can halt scheduler activity and freeze the system, providing a clear denial‑of‑service impact.

The flaw affects the Linux kernel in any release that includes the legacy lock ordering in scx_cgroup_lock(). No specific version range is documented, so any kernel built before the commit that swaps the lock order is potentially vulnerable. Systems running recent kernel releases that incorporate the patch described in the advisory are considered safe.

The CVE description does not provide a CVSS or EPSS score; the EPSS is listed as not available and the vulnerability is not in the CISA KEV catalog. The deadlock requires the execution of cgroup or scheduler‑extended API paths that acquire both the cgroup lock and the scx_cgroup_ops_rwsem. Based on the description, it is inferred that an attacker must have kernel‑level or privileged access to trigger these paths, as they are not exposed through standard user‑space interfaces. Consequently, the primary exploitation vector is local or privileged code, although any process that manipulates cgroup CPU weight settings could inadvertently exercise the vulnerable ordering and cause a system freeze. The absence of a publicly available exploit does not diminish the risk, because the conditions for deadlock can occur naturally under heavy or conflicting cgroup activity.