Description
In the Linux kernel, the following vulnerability has been resolved:

sched/core: Handle pick_task() releasing the rq lock

Core scheduling's pick_next_task() breaks when a ->pick_task()
implementation can release the rq lock. The selection state derived on entry
is only valid while the lock is held continuously. Once a pick can drop the
lock, an interleaving selection can invalidate all of it: the single-CPU
fast path can commit an uncookied pick although the core went cookied during
the release, and forceidle committed by the interleaving selection skews the
restarted pass's accounting.

Fix it by restarting the whole selection when a pick returns RETRY_TASK
after releasing the lock: a single restart point above the state derivation
replaces the per-loop restart labels, so a retry picks up state committed by
interleaving selections and accounts and resets forceidle like a fresh
selection would.

need_sync and fi_before latch across retries. Clock validity can't be
re-derived - there is no program-ordered way to tell whether the own and
core rq clocks are still updated after the lock was released, as other
lockers' pin cycles may or may not have invalidated them. When restarting,
clear core_clock_updated so that the sibling loop re-updates the core rq,
and update the own rq clock if invalidated.
Published: 2026-09-11
Score: 7.3 High
EPSS: < 1% Very Low
KEV: No
Impact: Potential system instability or denial of service
Action: Patch
AI Analysis

Impact

In the Linux kernel, a flaw in the core scheduling routine causes the pick_next_task() function to behave incorrectly when a custom pick_task() implementation releases the rq lock. Because the selection state is only valid while the lock is held, an interleaving selection after the lock is released can invalidate the entire scheduling decision, leading to tasks being dispatched incorrectly or kernel variables such as force in pick_task(), classified under CWE-367.

Affected Systems

The affected product is the Linux Kernel. The advisory does not list specific kernel versions, so all implementations of the Linux Kernel that expose the described scheduling path may be impacted until the fix is applied.

Risk and Exploitability

The vulnerability has a CVSS score of 7.3, indicating high severity. The EPSS score is very low (< 1%) and it is not listed in the CISA KEV catalog. The bug requires kernel code execution, so the most likely attack vector is local or requires elevated privileges. Because the flaw impacts internal scheduling decisions, an attacker with the ability to influence task scheduling could destabilize the system, potentially leading to performance degradation or denial of service. No publicly available exploits are currently documented, but the high severity and the potential for system instability warrant prompt attention.

Generated by OpenCVE AI on September 15, 2026 at 22:17 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply a kernel update that contains the scheduling bug fix. Follow vendor advisories for the latest distribution kernel releases.
  • If an immediate kernel upgrade is not possible, disable or avoid custom scheduler modules or services that employ pick_task() and could release the rq lock, reducing the chance of state invalidation.
  • Monitor kernel logs and performance counters for anomalous scheduling behavior, such as unexpected task switches or high idle time, and investigate any irregularities promptly.

Generated by OpenCVE AI on September 15, 2026 at 22:17 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Sun, 13 Sep 2026 06:45:00 +0000

Type Values Removed Values Added
Metrics cvssV3_1

{'score': 4.7, 'vector': 'CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H'}

 cvssV3_1

{'score': 7.3, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:H'}

Sat, 12 Sep 2026 00:15:00 +0000

Type Values Removed Values Added
Weaknesses CWE-367
References
Metrics threat_severity

None

 cvssV3_1

{'score': 4.7, 'vector': 'CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H'}

threat_severity

Moderate

Fri, 11 Sep 2026 23:45:00 +0000

Type Values Removed Values Added
Description In the Linux kernel, the following vulnerability has been resolved: sched/core: Handle pick_task() releasing the rq lock Core scheduling's pick_next_task() breaks when a ->pick_task() implementation can release the rq lock. The selection state derived on entry is only valid while the lock is held continuously. Once a pick can drop the lock, an interleaving selection can invalidate all of it: the single-CPU fast path can commit an uncookied pick although the core went cookied during the release, and forceidle committed by the interleaving selection skews the restarted pass's accounting. Fix it by restarting the whole selection when a pick returns RETRY_TASK after releasing the lock: a single restart point above the state derivation replaces the per-loop restart labels, so a retry picks up state committed by interleaving selections and accounts and resets forceidle like a fresh selection would. need_sync and fi_before latch across retries. Clock validity can't be re-derived - there is no program-ordered way to tell whether the own and core rq clocks are still updated after the lock was released, as other lockers' pin cycles may or may not have invalidated them. When restarting, clear core_clock_updated so that the sibling loop re-updates the core rq, and update the own rq clock if invalidated.
Title sched/core: Handle pick_task() releasing the rq lock
First Time appeared Linux
Linux linux Kernel
CPEs cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Vendors & Products Linux
Linux linux Kernel
References

Subscriptions

Linux Linux Kernel
cve-icon MITRE

Status: PUBLISHED

Assigner: Linux

Published:

Updated: 2026-09-13T06:30:19.786Z

Reserved: 2026-09-11T19:38:34.718Z

Link: CVE-2026-89521

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-09-11T20:19:34.767

Modified: 2026-09-13T07:17:14.450

Link: CVE-2026-89521

cve-icon Redhat

Severity : Moderate

Publid Date: 2026-09-11T19:44:03Z

Links: CVE-2026-89521 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-09-15T22:30:15Z

Weaknesses
  • CWE-367

    Time-of-check Time-of-use (TOCTOU) Race Condition