CVE-2025-21897: sched_ext: Fix pick_task_scx() picking non-queued tasks when it's called without balance()

Severity: medium (CVSS 5.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2025-04-01 · updated 2026-06-17
Weakness: CWE-667

Description

In the Linux kernel, the following vulnerability has been resolved: sched_ext: Fix pick_task_scx() picking non-queued tasks when it's called without balance() a6250aa251ea ("sched_ext: Handle cases where pick_task_scx() is called without preceding balance_scx()") added a workaround to handle the cases where pick_task_scx() is called without prececing balance_scx() which is due to a fair class bug where pick_taks_fair() may return NULL after a true return from balance_fair(). The workaround detects when pick_task_scx() is called without preceding balance_scx() and emulates SCX_RQ_BAL_KEEP and triggers kicking to avoid stalling. Unfortunately, the workaround code was testing whether @prev was on SCX to decide whether to keep the task running. This is incorrect as the task may be on SCX but no longer runnable. This could lead to a non-runnable task to be returned from pick_task_scx() which cause interesting confusions and failures. e.g. A common failure mode is the task ending up with (!on_rq && on_cpu) state which can cause potential wakers to busy loop, which can easily lead to deadlocks. Fix it by testing whether @prev has SCX_TASK_QUEUED set. This makes @prev_on_scx only used in one place. Open code the usage and improve the comment while at it.

Affected products

Linux kernel: from 6.12.1 before 6.12.18; from 6.13 before 6.13.6; 6.12, 6.14-rc1, 6.14-rc2, 6.14-rc3, 6.14-rc4 — fixed in 6.12.18, 6.13.6

How to fix

Upgrade to a fixed version: Linux kernel 6.12.18, 6.13.6. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2025-21897 or the next vulnerability affects your stack