CVE-2026-89520 (GCVE-0-2026-89520)
Vulnerability from cvelistv5
Published
2026-09-11 19:44
Modified
2026-10-21 12:47
Severity ?
7.8 (High) - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Summary
In the Linux kernel, the following vulnerability has been resolved: sched/core: Make core-sched flips wait for in-flight selections Core scheduling's pick_next_task() operates on all sibling rqs under one acquisition of the shared core-wide lock. A ->pick_task() that releases the rq lock leaves every sibling __lock momentarily free, letting __sched_core_flip(false) complete mid-selection and rebind rq_lockp() under it. The selection resumes on the split locks, touching sibling state it no longer protects, and __schedule() finally releases a lock that was never taken while leaking the one that was. Count in-flight core-wide selections in the leader's rq->core_pick_in_flight and make __sched_core_flip() wait for the count to drain. The count only changes under the shared lock, which the flip holds while sampling, so no other ordering is needed. The wait can repeat while selections overlap, but the flip backs off between samples and flips are rare cookie-lifetime events. sched_core_cpu_deactivate() moves the count to the new leader - a stale copy left behind would bias it forever if that CPU later returns as its own leader.
References
Impacted products
Vendor Product Version
Linux Linux Version: 539f65125d20aacab54d02d77f10a839f45b09dc
Version: 539f65125d20aacab54d02d77f10a839f45b09dc
Version: 539f65125d20aacab54d02d77f10a839f45b09dc
Version: 539f65125d20aacab54d02d77f10a839f45b09dc
Version: 539f65125d20aacab54d02d77f10a839f45b09dc
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "kernel/sched/core.c",
            "kernel/sched/sched.h"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "a2a16896ed53046f275f56a6cd8ca3fb6f12c4f3",
              "status": "affected",
              "version": "539f65125d20aacab54d02d77f10a839f45b09dc",
              "versionType": "git"
            },
            {
              "lessThan": "3e2511bffa93a639774a99e392181e21d28677e2",
              "status": "affected",
              "version": "539f65125d20aacab54d02d77f10a839f45b09dc",
              "versionType": "git"
            },
            {
              "lessThan": "9d69422ddaa13526c2223444e237d948d6e44728",
              "status": "affected",
              "version": "539f65125d20aacab54d02d77f10a839f45b09dc",
              "versionType": "git"
            },
            {
              "lessThan": "23eda24f325a6e6d686d30ec75f2e9d6745e2015",
              "status": "affected",
              "version": "539f65125d20aacab54d02d77f10a839f45b09dc",
              "versionType": "git"
            },
            {
              "lessThan": "f3629c63a4af3e491381780bc6c123cb498c4c40",
              "status": "affected",
              "version": "539f65125d20aacab54d02d77f10a839f45b09dc",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "kernel/sched/core.c",
            "kernel/sched/sched.h"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.14"
            },
            {
              "lessThan": "5.14",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.160",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.112",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.51",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.3",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.160",
                  "versionStartIncluding": "5.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.112",
                  "versionStartIncluding": "5.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.51",
                  "versionStartIncluding": "5.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2.4",
                  "versionStartIncluding": "5.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.3",
                  "versionStartIncluding": "5.14",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nsched/core: Make core-sched flips wait for in-flight selections\n\nCore scheduling\u0027s pick_next_task() operates on all sibling rqs under one\nacquisition of the shared core-wide lock. A -\u003epick_task() that releases the\nrq lock leaves every sibling __lock momentarily free, letting\n__sched_core_flip(false) complete mid-selection and rebind rq_lockp() under\nit. The selection resumes on the split locks, touching sibling state it no\nlonger protects, and __schedule() finally releases a lock that was never\ntaken while leaking the one that was.\n\nCount in-flight core-wide selections in the leader\u0027s rq-\u003ecore_pick_in_flight\nand make __sched_core_flip() wait for the count to drain. The count only\nchanges under the shared lock, which the flip holds while sampling, so no\nother ordering is needed. The wait can repeat while selections overlap, but\nthe flip backs off between samples and flips are rare cookie-lifetime\nevents.\n\nsched_core_cpu_deactivate() moves the count to the new leader - a stale copy\nleft behind would bias it forever if that CPU later returns as its own\nleader."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The race is in pick_next_task() and __sched_core_flip() in kernel/sched/core.c, reached locally via prctl(PR_SCHED_CORE) cookie create/drop and ordinary schedule() on SMT siblings; there is no network or adjacent-packet path.\nAC:L - The attacker enables core scheduling with PR_SCHED_CORE_CREATE, then drops the last cookie to queue __sched_core_flip(false) while forcing SMT-sibling scheduling so a lock-dropping pick_task() (CFS newidle or sched_ext) releases the shared rq lock; both sides of the race are attacker-controlled and retryable.\nPR:L - sched_core_share_pid() only requires ptrace_may_access(PTRACE_MODE_READ_REALCREDS) on the target, which an unprivileged process always has for itself, so prctl(PR_SCHED_CORE) needs no capability or init-namespace root.\nUI:N - No victim action such as mounting a filesystem or opening a file is required; the attacker enables core scheduling on their own tasks and races cookie teardown against their own threads\u0027 scheduling.\nS:U - Unprotected sibling runqueue accesses and unlocking the rebound rq lock corrupt host kernel scheduler state inside a single security authority; this is not a guest-to-host, IOMMU, or sandbox boundary crossing.\nC:H - After __sched_core_flip(false) rebinds rq_lockp() mid-selection, pick_next_task() keeps reading sibling rq and task_struct fields without the core-wide lock, so concurrent scheduler-structure corruption can be turned into a kernel memory-disclosure primitive.\nI:H - The same unlocked sibling walk can place one task_struct on two CPUs, and __schedule() then unlocks a lock it never took while leaking the shared core lock, yielding write and control-flow hijack primitives against scheduler state.\nA:H - Unlocking an unheld lock, leaking the shared core lock, and racing sibling runqueue mutation cause kernel oops, lockdep panics, deadlocks, and hangs."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-21T12:47:38.219Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/a2a16896ed53046f275f56a6cd8ca3fb6f12c4f3"
        },
        {
          "url": "https://git.kernel.org/stable/c/3e2511bffa93a639774a99e392181e21d28677e2"
        },
        {
          "url": "https://git.kernel.org/stable/c/9d69422ddaa13526c2223444e237d948d6e44728"
        },
        {
          "url": "https://git.kernel.org/stable/c/23eda24f325a6e6d686d30ec75f2e9d6745e2015"
        },
        {
          "url": "https://git.kernel.org/stable/c/f3629c63a4af3e491381780bc6c123cb498c4c40"
        }
      ],
      "title": "sched/core: Make core-sched flips wait for in-flight selections",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-89520",
    "datePublished": "2026-09-11T19:44:02.510Z",
    "dateReserved": "2026-09-11T19:38:34.718Z",
    "dateUpdated": "2026-10-21T12:47:38.219Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.