GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2026-89520 (GCVE-0-2026-89520)

Vulnerability from cvelistv5 – Published: 2026-09-11 19:44 – Updated: 2026-09-13 06:30
VLAI
Title
sched/core: Make core-sched flips wait for in-flight selections
Summary
In the Linux kernel, the following vulnerability has been resolved: sched/core: Make core-sched flips wait for in-flight selections Core scheduling's pick_next_task() operates on all sibling rqs under one acquisition of the shared core-wide lock. A ->pick_task() that releases the rq lock leaves every sibling __lock momentarily free, letting __sched_core_flip(false) complete mid-selection and rebind rq_lockp() under it. The selection resumes on the split locks, touching sibling state it no longer protects, and __schedule() finally releases a lock that was never taken while leaking the one that was. Count in-flight core-wide selections in the leader's rq->core_pick_in_flight and make __sched_core_flip() wait for the count to drain. The count only changes under the shared lock, which the flip holds while sampling, so no other ordering is needed. The wait can repeat while selections overlap, but the flip backs off between samples and flips are rare cookie-lifetime events. sched_core_cpu_deactivate() moves the count to the new leader - a stale copy left behind would bias it forever if that CPU later returns as its own leader.
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 539f65125d20aacab54d02d77f10a839f45b09dc , < 9d69422ddaa13526c2223444e237d948d6e44728 (git)
Affected: 539f65125d20aacab54d02d77f10a839f45b09dc , < 23eda24f325a6e6d686d30ec75f2e9d6745e2015 (git)
Affected: 539f65125d20aacab54d02d77f10a839f45b09dc , < f3629c63a4af3e491381780bc6c123cb498c4c40 (git)
guessed Create a notification for this product.
Linux Linux Affected: 5.14
Unaffected: 0 , < 5.14 (semver)
Unaffected: 6.18.51 , ≤ 6.18.* (semver)
Unaffected: 7.2.4 , ≤ 7.2.* (semver)
Unaffected: 7.3-rc1 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "kernel/sched/core.c",
            "kernel/sched/sched.h"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "9d69422ddaa13526c2223444e237d948d6e44728",
              "status": "affected",
              "version": "539f65125d20aacab54d02d77f10a839f45b09dc",
              "versionType": "git"
            },
            {
              "lessThan": "23eda24f325a6e6d686d30ec75f2e9d6745e2015",
              "status": "affected",
              "version": "539f65125d20aacab54d02d77f10a839f45b09dc",
              "versionType": "git"
            },
            {
              "lessThan": "f3629c63a4af3e491381780bc6c123cb498c4c40",
              "status": "affected",
              "version": "539f65125d20aacab54d02d77f10a839f45b09dc",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "kernel/sched/core.c",
            "kernel/sched/sched.h"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.14"
            },
            {
              "lessThan": "5.14",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.51",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.3-rc1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.51",
                  "versionStartIncluding": "5.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2.4",
                  "versionStartIncluding": "5.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.3-rc1",
                  "versionStartIncluding": "5.14",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nsched/core: Make core-sched flips wait for in-flight selections\n\nCore scheduling\u0027s pick_next_task() operates on all sibling rqs under one\nacquisition of the shared core-wide lock. A -\u003epick_task() that releases the\nrq lock leaves every sibling __lock momentarily free, letting\n__sched_core_flip(false) complete mid-selection and rebind rq_lockp() under\nit. The selection resumes on the split locks, touching sibling state it no\nlonger protects, and __schedule() finally releases a lock that was never\ntaken while leaking the one that was.\n\nCount in-flight core-wide selections in the leader\u0027s rq-\u003ecore_pick_in_flight\nand make __sched_core_flip() wait for the count to drain. The count only\nchanges under the shared lock, which the flip holds while sampling, so no\nother ordering is needed. The wait can repeat while selections overlap, but\nthe flip backs off between samples and flips are rare cookie-lifetime\nevents.\n\nsched_core_cpu_deactivate() moves the count to the new leader - a stale copy\nleft behind would bias it forever if that CPU later returns as its own\nleader."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The race is in pick_next_task() and __sched_core_flip() in kernel/sched/core.c, reached locally via prctl(PR_SCHED_CORE) cookie create/drop and ordinary schedule() on SMT siblings; there is no network or adjacent-packet path.\nAC:L - The attacker enables core scheduling with PR_SCHED_CORE_CREATE, then drops the last cookie to queue __sched_core_flip(false) while forcing SMT-sibling scheduling so a lock-dropping pick_task() (CFS newidle or sched_ext) releases the shared rq lock; both sides of the race are attacker-controlled and retryable.\nPR:L - sched_core_share_pid() only requires ptrace_may_access(PTRACE_MODE_READ_REALCREDS) on the target, which an unprivileged process always has for itself, so prctl(PR_SCHED_CORE) needs no capability or init-namespace root.\nUI:N - No victim action such as mounting a filesystem or opening a file is required; the attacker enables core scheduling on their own tasks and races cookie teardown against their own threads\u0027 scheduling.\nS:U - Unprotected sibling runqueue accesses and unlocking the rebound rq lock corrupt host kernel scheduler state inside a single security authority; this is not a guest-to-host, IOMMU, or sandbox boundary crossing.\nC:H - After __sched_core_flip(false) rebinds rq_lockp() mid-selection, pick_next_task() keeps reading sibling rq and task_struct fields without the core-wide lock, so concurrent scheduler-structure corruption can be turned into a kernel memory-disclosure primitive.\nI:H - The same unlocked sibling walk can place one task_struct on two CPUs, and __schedule() then unlocks a lock it never took while leaking the shared core lock, yielding write and control-flow hijack primitives against scheduler state.\nA:H - Unlocking an unheld lock, leaking the shared core lock, and racing sibling runqueue mutation cause kernel oops, lockdep panics, deadlocks, and hangs."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-13T06:30:18.475Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/9d69422ddaa13526c2223444e237d948d6e44728"
        },
        {
          "url": "https://git.kernel.org/stable/c/23eda24f325a6e6d686d30ec75f2e9d6745e2015"
        },
        {
          "url": "https://git.kernel.org/stable/c/f3629c63a4af3e491381780bc6c123cb498c4c40"
        }
      ],
      "title": "sched/core: Make core-sched flips wait for in-flight selections",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-89520",
    "datePublished": "2026-09-11T19:44:02.510Z",
    "dateReserved": "2026-09-11T19:38:34.718Z",
    "dateUpdated": "2026-09-13T06:30:18.475Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-89520",
      "date": "2026-09-17",
      "epss": "0.00161",
      "percentile": "0.05753"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-89520\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2026-09-11T20:19:34.647\",\"lastModified\":\"2026-09-13T07:17:14.323\",\"vulnStatus\":\"Received\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nsched/core: Make core-sched flips wait for in-flight selections\\n\\nCore scheduling\u0027s pick_next_task() operates on all sibling rqs under one\\nacquisition of the shared core-wide lock. A -\u003epick_task() that releases the\\nrq lock leaves every sibling __lock momentarily free, letting\\n__sched_core_flip(false) complete mid-selection and rebind rq_lockp() under\\nit. The selection resumes on the split locks, touching sibling state it no\\nlonger protects, and __schedule() finally releases a lock that was never\\ntaken while leaking the one that was.\\n\\nCount in-flight core-wide selections in the leader\u0027s rq-\u003ecore_pick_in_flight\\nand make __sched_core_flip() wait for the count to drain. The count only\\nchanges under the shared lock, which the flip holds while sampling, so no\\nother ordering is needed. The wait can repeat while selections overlap, but\\nthe flip backs off between samples and flips are rare cookie-lifetime\\nevents.\\n\\nsched_core_cpu_deactivate() moves the count to the new leader - a stale copy\\nleft behind would bias it forever if that CPU later returns as its own\\nleader.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"kernel/sched/core.c\",\"kernel/sched/sched.h\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"539f65125d20aacab54d02d77f10a839f45b09dc\",\"lessThan\":\"9d69422ddaa13526c2223444e237d948d6e44728\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"539f65125d20aacab54d02d77f10a839f45b09dc\",\"lessThan\":\"23eda24f325a6e6d686d30ec75f2e9d6745e2015\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"539f65125d20aacab54d02d77f10a839f45b09dc\",\"lessThan\":\"f3629c63a4af3e491381780bc6c123cb498c4c40\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"kernel/sched/core.c\",\"kernel/sched/sched.h\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"5.14\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"5.14\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.18.51\",\"lessThanOrEqual\":\"6.18.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.2.4\",\"lessThanOrEqual\":\"7.2.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.3-rc1\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9}]},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/23eda24f325a6e6d686d30ec75f2e9d6745e2015\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/9d69422ddaa13526c2223444e237d948d6e44728\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/f3629c63a4af3e491381780bc6c123cb498c4c40\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-09-13T06:56:53+00:00",
      "cve": "CVE-2026-89520",
      "id": "CVE-2026-89520",
      "initial_release_date": "2026-09-11T19:44:02.510000+00:00",
      "product_status:known_affected": "2",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: Linux kernel: Core scheduling vulnerability leads to system instability",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-89520.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-09-16T15:37:28Z",
      "cve": "CVE-2026-89520",
      "id": "CVE-2026-89520",
      "initial_release_date": "2026-09-12T16:27:00Z",
      "product_status:known_affected": "210",
      "product_status:known_not_affected": "143",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-89520",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-89520.json",
      "version": "4"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.