The flaw arises from the kernel’s SCX_RQ_BAL_KEEP flag, which was used to signal that a previously selected task should continue running. Because scheduling picks and dispatches are no longer guaranteed to occur one‑to‑one, the flag can be left stale after a task has been dequeued. When the scheduler later re‑reads this stale value it may still treat the task as active, leading to incorrect scheduling decisions., classified as CWE‑367.

The issue is present in include the legacy SCX_RQ_BAL_KEEP flag. Systems running kernels released before the commit that kernels that retain it—are potentially affected. The CPE entry identifies the entire range of affected Linux kernel versions until the patch is applied.

The CVSS score of 5.5 indicates a moderate severity, and the EPSS score of less than 1% suggests a low probability of exploitation. The vulnerability is not listed in the CISA KEV catalog. An attacker would need kernel‑level or privileged execution to exploit is local or requires privilege escalation, which is inferred from the kernel‑level nature of the flaw. Because the vulnerability does not directly expose secrets or cause a direct denial of service, the overall risk remains moderate until the official patch removes the stale flag logic.