The vulnerability resides in the Linux kernel’s sched_ext CPU controller module and arises from incorrect lock ordering in the function scx_cgroup_lock(), illustrating a CWE‑833 Lock Order Vulnerability. The routine first acquires a write lock on scx_cgroup_ops_rwsem and then calls cgroup_lock(). When a thread removes a cgroup (rmdir) while another thread is writing to the cpu.weight file, a circular wait forms with the kernfs subsystem. The rmdir operation waits for the cgroup lock while the weight write is blocked on the rwsem, leading to a deadlock that stalls the scheduler. The result is a denial‑of‑service state in which the kernel cannot schedule new tasks until the deadlock is broken.

Any Linux kernel that includes the sched_ext CPU controller and has not yet incorporated the lock‑ordering fix (commits 2ca6b43ef… or 5f8b69642…). This includes all mainstream kernel releases prior to those commits, regardless of distribution, as the vulnerability is tied to the kernel source rather than a specific vendor build.

The CVSS base score of 5.5 indicates moderate severity, while the EPSS score of less than 1 % suggests a low probability of exploitation in the wild. The issue is not listed in CISA’s KEV catalog. Because the deadlock is triggered by concurrent cgroup operations typically performed by a user with the necessary privileges (CAP_SYS_ADMIN), the likely attack vector is local. An attacker who can manipulate cgroup files could force the system into a scheduler stall, resulting in a denial of service for all users. The overall risk is moderate, but the low exploitation likelihood reduces urgency for environments that already have mitigation in place.