SB2026070278 - NULL pointer dereference in Linux kernel sched

Description

This security bulletin contains information about 1 vulnerability.

1) NULL pointer dereference (CVE-ID: CVE-2026-53328)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper handling of a NULL pointer state in scx_cgroup_move_task() when processing cgroup migration events under a sched_ext scheduler. A local user can trigger cgroup subtree_control changes to cause a kernel warning and destabilize the system.

The issue occurs when migration is driven by css identity rather than cgroup identity, allowing a legitimate css-only migration to reach the function with cgrp_moving_from unset.

Remediation

Install update from vendor's website.

References

• https://git.kernel.org/stable/c/02e545c4297a26dbbc41df81b831e7f605bcd306
• https://git.kernel.org/stable/c/0ffcad63b19a1cadb475c9f405a93607fdcd0d7c
• https://git.kernel.org/stable/c/bc75f5951fac4e49d175c4433fc08fb1ec01172f
• https://git.kernel.org/stable/c/cdff2eb97be147d2ce52ac1327841068781f25dc