SB20260502120 - Improper control of a resource through its lifetime in Linux kernel sched

Description

This security bulletin contains information about 1 vulnerability.

1) Improper control of a resource through its lifetime (CVE-ID: CVE-2026-31733)

CWE-ID: CWE-664 - Improper control of a resource through its lifetime

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper state management in sched_ext direct dispatch state handling when processing task wakeups and enqueue or dequeue paths. A local user can trigger task scheduling paths that leave stale direct dispatch state set to cause a denial of service.

The issue can trigger a spurious kernel warning when a subsequent wakeup causes ops.select_cpu() to call scx_bpf_dsq_insert().

Remediation

Install update from vendor's website.

References

• https://git.kernel.org/stable/c/5e7b2cc8fae9ec2a5bc53311191d2faaff75a4b5
• https://git.kernel.org/stable/c/7e0ffb72de8aa3b25989c2d980e81b829c577010
• https://git.kernel.org/stable/c/7ea601daa0153e19cd1c6e6b300348c70c05fe77
• https://git.kernel.org/stable/c/ca685511f7afd42cdcbb0feea42e5d332d384251