{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-89520","assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","state":"PUBLISHED","assignerShortName":"Linux","dateReserved":"2026-09-11T19:38:34.718Z","datePublished":"2026-09-11T19:44:02.510Z","dateUpdated":"2026-10-03T10:56:33.453Z"},"containers":{"cna":{"providerMetadata":{"orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","shortName":"Linux","dateUpdated":"2026-10-03T10:56:33.453Z"},"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nsched/core: Make core-sched flips wait for in-flight selections\n\nCore scheduling's pick_next_task() operates on all sibling rqs under one\nacquisition of the shared core-wide lock. A ->pick_task() that releases the\nrq lock leaves every sibling __lock momentarily free, letting\n__sched_core_flip(false) complete mid-selection and rebind rq_lockp() under\nit. The selection resumes on the split locks, touching sibling state it no\nlonger protects, and __schedule() finally releases a lock that was never\ntaken while leaking the one that was.\n\nCount in-flight core-wide selections in the leader's rq->core_pick_in_flight\nand make __sched_core_flip() wait for the count to drain. The count only\nchanges under the shared lock, which the flip holds while sampling, so no\nother ordering is needed. The wait can repeat while selections overlap, but\nthe flip backs off between samples and flips are rare cookie-lifetime\nevents.\n\nsched_core_cpu_deactivate() moves the count to the new leader - a stale copy\nleft behind would bias it forever if that CPU later returns as its own\nleader."}],"metrics":[{"cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH"},"scenarios":[{"lang":"en","value":"AV:L - The race is in pick_next_task() and __sched_core_flip() in kernel/sched/core.c, reached locally via prctl(PR_SCHED_CORE) cookie create/drop and ordinary schedule() on SMT siblings; there is no network or adjacent-packet path.\nAC:L - The attacker enables core scheduling with PR_SCHED_CORE_CREATE, then drops the last cookie to queue __sched_core_flip(false) while forcing SMT-sibling scheduling so a lock-dropping pick_task() (CFS newidle or sched_ext) releases the shared rq lock; both sides of the race are attacker-controlled and retryable.\nPR:L - sched_core_share_pid() only requires ptrace_may_access(PTRACE_MODE_READ_REALCREDS) on the target, which an unprivileged process always has for itself, so prctl(PR_SCHED_CORE) needs no capability or init-namespace root.\nUI:N - No victim action such as mounting a filesystem or opening a file is required; the attacker enables core scheduling on their own tasks and races cookie teardown against their own threads' scheduling.\nS:U - Unprotected sibling runqueue accesses and unlocking the rebound rq lock corrupt host kernel scheduler state inside a single security authority; this is not a guest-to-host, IOMMU, or sandbox boundary crossing.\nC:H - After __sched_core_flip(false) rebinds rq_lockp() mid-selection, pick_next_task() keeps reading sibling rq and task_struct fields without the core-wide lock, so concurrent scheduler-structure corruption can be turned into a kernel memory-disclosure primitive.\nI:H - The same unlocked sibling walk can place one task_struct on two CPUs, and __schedule() then unlocks a lock it never took while leaking the shared core lock, yielding write and control-flow hijack primitives against scheduler state.\nA:H - Unlocking an unheld lock, leaking the shared core lock, and racing sibling runqueue mutation cause kernel oops, lockdep panics, deadlocks, and hangs."}]}],"affected":[{"product":"Linux","vendor":"Linux","defaultStatus":"unaffected","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["kernel/sched/core.c","kernel/sched/sched.h"],"versions":[{"version":"539f65125d20aacab54d02d77f10a839f45b09dc","lessThan":"3e2511bffa93a639774a99e392181e21d28677e2","status":"affected","versionType":"git"},{"version":"539f65125d20aacab54d02d77f10a839f45b09dc","lessThan":"9d69422ddaa13526c2223444e237d948d6e44728","status":"affected","versionType":"git"},{"version":"539f65125d20aacab54d02d77f10a839f45b09dc","lessThan":"23eda24f325a6e6d686d30ec75f2e9d6745e2015","status":"affected","versionType":"git"},{"version":"539f65125d20aacab54d02d77f10a839f45b09dc","lessThan":"f3629c63a4af3e491381780bc6c123cb498c4c40","status":"affected","versionType":"git"}]},{"product":"Linux","vendor":"Linux","defaultStatus":"affected","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["kernel/sched/core.c","kernel/sched/sched.h"],"versions":[{"version":"5.14","status":"affected"},{"version":"0","lessThan":"5.14","status":"unaffected","versionType":"semver"},{"version":"6.12.112","lessThanOrEqual":"6.12.*","status":"unaffected","versionType":"semver"},{"version":"6.18.51","lessThanOrEqual":"6.18.*","status":"unaffected","versionType":"semver"},{"version":"7.2.4","lessThanOrEqual":"7.2.*","status":"unaffected","versionType":"semver"},{"version":"7.3-rc1","lessThanOrEqual":"*","status":"unaffected","versionType":"original_commit_for_fix"}]}],"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.14","versionEndExcluding":"6.12.112"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.14","versionEndExcluding":"6.18.51"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.14","versionEndExcluding":"7.2.4"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.14","versionEndExcluding":"7.3-rc1"}]}]}],"references":[{"url":"https://git.kernel.org/stable/c/3e2511bffa93a639774a99e392181e21d28677e2"},{"url":"https://git.kernel.org/stable/c/9d69422ddaa13526c2223444e237d948d6e44728"},{"url":"https://git.kernel.org/stable/c/23eda24f325a6e6d686d30ec75f2e9d6745e2015"},{"url":"https://git.kernel.org/stable/c/f3629c63a4af3e491381780bc6c123cb498c4c40"}],"title":"sched/core: Make core-sched flips wait for in-flight selections","x_generator":{"engine":"bippy-1.2.0"}}}}