In the Linux kernel, the following vulnerability has been resolved:
sched_ext: Fix incorrect autogroup migration detection
scx_move_task() is called from sched_move_task() and tells the BPF scheduler that cgroup migration is being committed. sched_move_task() is used by both cgroup and autogroup migrations and scx_move_task() tried to filter out autogroup migrations by testing the destination cgroup and PF_EXITING but this is not enough. In fact, without explicitly tagging the thread which is doing the cgroup migration, there is no good way to tell apart scx_move_task() invocations for racing migration to the root cgroup and an autogroup migration.
This led to scx_move_task() incorrectly ignoring a migration from non-root cgroup to an autogroup of the root cgroup triggering the following warning:
WARNING: CPU: 7 PID: 1 at kernel/sched/ext.c:3725 scx_cgroup_can_attach+0x196/0x340 ... Call Trace: <TASK> cgroup_migrate_execute+0x5b1/0x700 cgroup_attach_task+0x296/0x400 __cgroup_procs_write+0x128/0x140 cgroup_procs_write+0x17/0x30 kernfs_fop_write_iter+0x141/0x1f0 vfs_write+0x31d/0x4a0 __x64_sys_write+0x72/0xf0 do_syscall_64+0x82/0x160 entry_SYSCALL_64_after_hwframe+0x76/0x7e
Fix it by adding an argument to sched_move_task() that indicates whether the moving is for a cgroup or autogroup migration. After the change, scx_move_task() is called only for cgroup migrations and renamed to scx_cgroup_move_task().
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade linux | Jul 23, 2026 | Jul 23, 2026 |
| Oracle_linux | — | Upgrade kernel | Dec 3, 2025 | Feb 27, 2025 |
| Redhat_linux | — | Upgrade kernel-rtUpgrade kernelNo solution exists | Jul 9, 2025 | Feb 27, 2025 |
| Rocky_linux | — | Upgrade kernel-rt-debug-coreUpgrade kernel-rt-debug-debuginfoUpgrade rvUpgrade kernel-debug-modules-extraUpgrade kernel-debuginfo-common-x86_64Upgrade kernel-zfcpdump-coreUpgrade kernel-zfcpdump-modulesUpgrade kernel-rt-debug-modules-coreUpgrade kernel-debug-modules-coreUpgrade kernel-modules-coreUpgrade kernel-rt-debuginfoUpgrade kernel-debug-devel-matchedUpgrade kernel-rt-modulesUpgrade kernel-debug-modulesUpgrade kernel-rt-modules-coreUpgrade kernel-zfcpdump-modules-coreUpgrade kernel-uki-virt-addonsUpgrade kernel-rtUpgrade libperf-debuginfoUpgrade kernel-tools-libsUpgrade kernel-debuginfo-common-s390xUpgrade kernel-debug-debuginfoUpgrade kernel-toolsUpgrade kernel-tools-libs-develUpgrade kernel-devel-matchedUpgrade kernel-modules-extra-matchedUpgrade kernel-zfcpdumpUpgrade libperfUpgrade kernel-uki-virtUpgrade kernel-rt-debug-develUpgrade kernel-rt-debugUpgrade kernel-develUpgrade kernel-rt-coreUpgrade kernel-debug-develUpgrade python3-perf-debuginfoUpgrade python3-perfUpgrade kernel-rt-develUpgrade kernelUpgrade kernel-zfcpdump-devel-matchedUpgrade kernel-zfcpdump-develUpgrade kernel-debug-uki-virtUpgrade perfUpgrade rtlaUpgrade kernel-tools-debuginfoUpgrade kernel-debug-coreUpgrade kernel-debugUpgrade kernel-debuginfoUpgrade perf-debuginfoUpgrade kernel-zfcpdump-debuginfoUpgrade kernel-rt-debug-modules-extraUpgrade kernel-modules-extraUpgrade kernel-modulesUpgrade kernel-coreUpgrade kernel-zfcpdump-modules-extraUpgrade kernel-rt-modules-extraUpgrade kernel-rt-debug-modules | Feb 5, 2026 | Nov 27, 2025 |
| Suse | — | Upgrade kernel-defaultUpgrade kernel-default-develUpgrade kernel-zfcpdumpUpgrade kernel-64kb-develUpgrade kernel-64kb-extraUpgrade kernel-default-livepatchUpgrade kernel-docsUpgrade kernel-64kbUpgrade kernel-docs-htmlUpgrade kernel-symsUpgrade kernel-azure-extraUpgrade kernel-develUpgrade kernel-default-vdsoUpgrade kernel-devel-azureUpgrade kernel-sourceUpgrade kernel-source-vanillaUpgrade kernel-kvmsmall-develUpgrade kernel-default-extraUpgrade kernel-kvmsmall-vdsoUpgrade kernel-azure-develUpgrade kernel-macrosUpgrade kernel-source-azureUpgrade kernel-kvmsmallUpgrade kernel-azureUpgrade kernel-azure-vdsoUpgrade kernel-obs-qa | Dec 5, 2025 | Dec 5, 2025 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub