In the Linux kernel, a flaw in the core scheduling routine causes the pick_next_task() function to behave incorrectly when a custom pick_task() implementation releases the rq lock. Because the selection state is only valid while the lock is held, an interleaving selection after the lock is released can invalidate the entire scheduling decision, leading to tasks being dispatched incorrectly or kernel variables such as forceidle becoming skewed. The vulnerability is characterized by the improper handling of the retry path in pick_task(), classified under CWE‑367.

The affected product is the Linux Kernel. The advisory does not list specific kernel versions, so all implementations of the Linux Kernel that expose the described scheduling path may be impacted until the fix is applied.

The CVSS base score of 4.7 indicates a moderate severity. The EPSS score is very low (< 1%) and the vulnerability is not listed in the CISA KEV catalog. The requirement to execute code in kernel space means that the attack vector is likely local or requires elevated privileges. Because the bug affects internal scheduling decisions, an attacker with the ability to influence task scheduling could destabilize the system, potentially causing performance degradation or denial of service. The lack of publicly available exploits and the moderate score suggest a lower immediate threat, but the impact on system stability warrants monitoring.