The vulnerability is a race condition in the Linux kernel’s scheduling subsystem. While a CPU is executing ops.dequeue() and has not cleared the SCX_OPSS_DISPATCHING flag, a task may appear on a non‑local DSQ. Paths that consume or move tasks do not wait for the dispatch to finish, allowing concurrent modifications to the same task. This unsynchronized access can corrupt kernel state or cause instability in task scheduling.

The flaw exists in the Linux kernel across all releases that have not yet incorporated the fix referenced in the supplied Git commits. No explicit version range is given, so any kernel built before the patch is potentially affected.

The CVSS score of 7.8 indicates high severity, but the EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog. Based on the description, the attack likely requires local access with the ability to influence task scheduling; exploitation would involve hijacking or racing the dispatcher. The risk is moderate, with a focus on potential kernel instability rather than confirmed privilege escalation or direct memory corruption.