GHSA-2JJ9-3XXJ-4V43
Vulnerability from github – Published: 2026-09-11 21:31 – Updated: 2026-09-13 09:32In the Linux kernel, the following vulnerability has been resolved:
sched/core: Handle pick_task() releasing the rq lock
Core scheduling's pick_next_task() breaks when a ->pick_task() implementation can release the rq lock. The selection state derived on entry is only valid while the lock is held continuously. Once a pick can drop the lock, an interleaving selection can invalidate all of it: the single-CPU fast path can commit an uncookied pick although the core went cookied during the release, and forceidle committed by the interleaving selection skews the restarted pass's accounting.
Fix it by restarting the whole selection when a pick returns RETRY_TASK after releasing the lock: a single restart point above the state derivation replaces the per-loop restart labels, so a retry picks up state committed by interleaving selections and accounts and resets forceidle like a fresh selection would.
need_sync and fi_before latch across retries. Clock validity can't be re-derived - there is no program-ordered way to tell whether the own and core rq clocks are still updated after the lock was released, as other lockers' pin cycles may or may not have invalidated them. When restarting, clear core_clock_updated so that the sibling loop re-updates the core rq, and update the own rq clock if invalidated.
{
"affected": [],
"aliases": [
"CVE-2026-89521"
],
"database_specific": {
"cwe_ids": [],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-09-11T20:19:34Z",
"severity": "HIGH"
},
"details": "In the Linux kernel, the following vulnerability has been resolved:\n\nsched/core: Handle pick_task() releasing the rq lock\n\nCore scheduling\u0027s pick_next_task() breaks when a -\u003epick_task()\nimplementation can release the rq lock. The selection state derived on entry\nis only valid while the lock is held continuously. Once a pick can drop the\nlock, an interleaving selection can invalidate all of it: the single-CPU\nfast path can commit an uncookied pick although the core went cookied during\nthe release, and forceidle committed by the interleaving selection skews the\nrestarted pass\u0027s accounting.\n\nFix it by restarting the whole selection when a pick returns RETRY_TASK\nafter releasing the lock: a single restart point above the state derivation\nreplaces the per-loop restart labels, so a retry picks up state committed by\ninterleaving selections and accounts and resets forceidle like a fresh\nselection would.\n\nneed_sync and fi_before latch across retries. Clock validity can\u0027t be\nre-derived - there is no program-ordered way to tell whether the own and\ncore rq clocks are still updated after the lock was released, as other\nlockers\u0027 pin cycles may or may not have invalidated them. When restarting,\nclear core_clock_updated so that the sibling loop re-updates the core rq,\nand update the own rq clock if invalidated.",
"id": "GHSA-2jj9-3xxj-4v43",
"modified": "2026-09-13T09:32:16Z",
"published": "2026-09-11T21:31:30Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-89521"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/88ed5a66467ca2a5148b9997af9c71d8c43060ad"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/c10b216a072ff5c57bc880a05f87eb519aecc529"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:H",
"type": "CVSS_V3"
}
]
}
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.