The Linux kernel scheduler contains a flaw that occurs when a CPU is removed while tasks are residing in the BPF scheduler or user DSQ. The hotplug thread waits for the per-CPU run queue to become empty, but the CPU stops dispatching tasks once it becomes inactive, leaving tasks still counted on its run queue. This can lead to the hotplug thread never being woken, causing the kernel to hold the cpu_hotplug_lock indefinitely and the system to hang during a CPU hotplug operation. The issue is an ordering bug that creates a deadlock condition within the CPU hotplug logic.

All Linux kernel implementations are affected; the vulnerability applies to every kernel version prior to the official fix. No specific version campaign is listed, so any system running an unpatched kernel may encounter the problem when performing CPU hotplug operations or triggering CPU removal via sysfs or the kernel watchdog.

Because the flaw manifests internally within the kernel scheduler, it does not expose a remote code execution vector. However, the resulting hang defeats normal system operation and can be exploited by a local user with sufficient privileged access to trigger CPU hotplug requests, leading to a denial of service. The CVSS score is 4.1 and the EPSS score is < 1%. The exploit requires local privileges and an unpatched kernel; no public exploit is listed. Without a patch, a system could become unavailable for CPU hotplug or recover only after a reboot or watchdog reset. The KEV status is not listed, indicating no known widespread exploitation at time of publication.