The vulnerability originates from incorrect assumptions that the runqueue returned by this_rq() matches the dispatched runqueue in core scheduling functions. When a dispatch targets a sibling CPU, this mismatch can cause scheduler functions such as scx_dsq_move, scx_bpf_sub_dispatch, finish_dispatch, scx_bpf_dsq_reenq, and scx_bpf_dsq_nr_queued to acquire locks in the wrong order or resolve local DSQ incorrectly, leading to deadlock and loss of scheduling responsiveness. The flaw is classified as CWE-833, a deadlock that results in denial of service, but does not affect confidentialityWith a CVSS score of 4.7 the vulnerability represents moderate severity. The EPSS score is < 1%, indicating a very low probability of exploitation. It is not listed in the CISA local access to the kernel scheduler – an attacker would need to trigger dispatch to a sibling runqueue, which is typically achieved primary consequence is a deadlock during runqueue locking that can freeze scheduling, leading to a denial of service, but it does not provide privilege escalation or data corruption.

All Linux kernel users are impacted: the affected code resides in sched_ext and core scheduling. Any kernel version that has not yet incorporated the commits c3adb96d2e0d71b9ea21359 or 6d1890d3c6137ab523799765ae2de62cc05f116d is vulnerable. Linux kernel versions from standard distributions, including embedded, server, and desktop, must verify their kernel version and apply the patch.

The CVSS score of 4.7 classifies the vulnerability as moderate severity. The EPSS score of < 1% suggests a very low probability of real‑world exploitation. The vulnerability is not listed in CISA’s KEV catalog. The flaw arises from incorrect assumptions about the target runqueue during dispatch, allowing an attacker with the ability to trigger a dispatch to a sibling runqueue to potentially cause a deadlock and disrupt scheduling. However, the attack surface appears limited to kernel‑level conditions and no confirmed public exploits currently exist.