CVSS 3.1
Вероятност да бъде експлоатирана в следващите 30 дни (EPSS)
Атакува се
Време до експлоатация
Атакува се локално, без особени условия, с обикновен потребителски вход и без действие от потребителя.
Описание
Оригинално описание
In the Linux kernel, the following vulnerability has been resolved: sched_ext: Skip sub-disable teardown for never-linked sub-schedulers A sub-scheduler enable can fail before scx_link_sched() links the sched into the hierarchy, e.g. when the parent is already being disabled, and cleanup still runs the full scx_sub_disable(). That is racy against root disable: drain_descendants() is the only ordering between a sub's disable-time task walk and root disable's all-task teardown, and an unlinked sub is invisible to it. Root's teardown can thus run between the never-linked sub's drain and its walk, exiting every task to no scheduler. The walk then trips the membership WARN and re-homes the exited tasks onto the dying hierarchy, a use-after-free. Skip the cgroup ownership reset and the task walk if @sch was never linked, indicated by the empty ->sibling as unlinking only happens later in the same function. The membership WARN remains valid: a linked sub is always waited on by an ancestor's drain.
Засегнати продукти
- Linux Linux: 337ec00b1d9c676f637651c2cefddb8612b867ee преди 6428093a4a986c38c9089b5eb32b56d914ef437a; 337ec00b1d9c676f637651c2cefddb8612b867ee преди 8c13364db9c9a43ed286f3a8d0fb9477b1adc43c
- Linux Linux: 7.1; преди 7.1; 7.1.9 до 7.1.*; от 7.2 нататък
История
- 22 август 2026 Публикувано