Description
In the Linux kernel, the following vulnerability has been resolved:

sched_ext: Replace SCX_RQ_BAL_KEEP with a dispatch verdict return

SCX_RQ_BAL_KEEP tells the pick to keep running the previous task, a leftover
from when balancing and picking were separate operations. An rq-level flag
only works while dispatches and picks pair up one to one, which core
scheduling breaks: selections interleave through dispatch's lock drops and a
pick can consume a stale flag, keeping a task that has since been dequeued.
Fixing core scheduling support requires the decision to travel with the
dispatch that made it. Make scx_dispatch_sched() and balance_one() return an
explicit verdict instead and drop the flag's plumbing from the tools autogen
enum headers.

Also factor the pick-side invocation, its follow-up queueing and the
post-dispatch checks out of do_pick_task_scx() into dispatch_pick(). No
functional changes intended.

v2: Drop the SCX_RQ_BAL_KEEP plumbing from the tools autogen enum headers
as well (Andrea).
Published: 2026-09-11
Score: 5.5 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Race condition in Linux scheduler causing improper task scheduling
Action: Patch Kernel
AI Analysis

Impact

The Linux kernel bug involves the obsolete SCX_RQ_BAL_KEEP flag, which caused older scheduling code to continue running a task after it had been dequeued. Replacing the flag with an explicit dispatch verdict return eliminates a race between dispatch and pick operations, restoring correct task selection behavior. The flaw is a scheduling error that could lead to mis‑directed CPU time but does not expose secrets or provide direct code‑execution.

Affected Systems

All Linux kernel releases that contain the flag before the commit that removes it are affected. The patch is integrated into kernel versions released after that commit, so any distribution kernel earlier than that point remains vulnerable until upgraded.

Risk and Exploitability

The CVSS score of 5.5 indicates medium severity. The EPSS score is less than 1%, implying a very low probability of exploitation, and the vulnerability is not catalogued in CISA’s KEV list. Successful exploitation would require an attacker to run code with kernel privileges to trigger the scheduling race; no publicly documented exploits exist.

Generated by OpenCVE AI on September 21, 2026 at 01:22 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade the Linux kernel to a release that contains the commit replacing SCX_RQ_BAL_KEEP with an explicit dispatch verdict return.
  • If using a custom or older kernel build, apply the patch changes described in the advisory to remove the stale flag plumbing and add the explicit verdict logic, thereby addressing the synchronization flaw identified by CWE-367.
  • Schedule the kernel upgrade as part of routine patch management, ensuring that the updated scheduling code is in use before deploying new workloads.

Generated by OpenCVE AI on September 21, 2026 at 01:22 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Sat, 12 Sep 2026 00:15:00 +0000

Type Values Removed Values Added
Weaknesses CWE-367
References
Metrics threat_severity

None

 cvssV3_1

{'score': 5.5, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'}

threat_severity

Moderate

Fri, 11 Sep 2026 23:45:00 +0000

Type Values Removed Values Added
Description In the Linux kernel, the following vulnerability has been resolved: sched_ext: Replace SCX_RQ_BAL_KEEP with a dispatch verdict return SCX_RQ_BAL_KEEP tells the pick to keep running the previous task, a leftover from when balancing and picking were separate operations. An rq-level flag only works while dispatches and picks pair up one to one, which core scheduling breaks: selections interleave through dispatch's lock drops and a pick can consume a stale flag, keeping a task that has since been dequeued. Fixing core scheduling support requires the decision to travel with the dispatch that made it. Make scx_dispatch_sched() and balance_one() return an explicit verdict instead and drop the flag's plumbing from the tools autogen enum headers. Also factor the pick-side invocation, its follow-up queueing and the post-dispatch checks out of do_pick_task_scx() into dispatch_pick(). No functional changes intended. v2: Drop the SCX_RQ_BAL_KEEP plumbing from the tools autogen enum headers as well (Andrea).
Title sched_ext: Replace SCX_RQ_BAL_KEEP with a dispatch verdict return
First Time appeared Linux
Linux linux Kernel
CPEs cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Vendors & Products Linux
Linux linux Kernel
References

Subscriptions

Linux Linux Kernel
cve-icon MITRE

Status: PUBLISHED

Assigner: Linux

Published:

Updated: 2026-09-11T19:44:01.858Z

Reserved: 2026-09-11T19:38:34.718Z

Link: CVE-2026-89519

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-09-11T20:19:34.533

Modified: 2026-09-11T20:19:34.533

Link: CVE-2026-89519

cve-icon Redhat

Severity : Moderate

Publid Date: 2026-09-11T19:44:01Z

Links: CVE-2026-89519 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-09-21T01:30:08Z

Weaknesses
  • CWE-367

    Time-of-check Time-of-use (TOCTOU) Race Condition