https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Thu, 01 Oct 2026 05:34:14 +0000 https://vulnerability.circl.lu/vuln/cve-2026-74593 <p><strong>Affected:</strong> Linux</p> <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>sched_ext: Take cgroup_lock() first in scx_cgroup_lock()</p> <p>scx_cgroup_lock() write-locks scx_cgroup_ops_rwsem and then takes cgroup_lock(), which can deadlock through kernfs:</p> <p>scx enable/disable cgroup rmdir cpu.weight write ------------------ ------------ ---------------- cgroup_lock() percpu_down_write(rwsem) cgroup_lock() kernfs_get_active() percpu_down_read(rwsem) kernfs_drain()</p> <p>The enable path waits for the rmdir to release cgroup_mutex. The rmdir, deactivating the cpu controller&#39;s files, waits in kernfs_drain() for the write&#39;s active reference. The write, in scx_group_set_weight(), waits for the rwsem behind the pending writer.</p> <p>Take cgroup_lock() first. The set_* paths take no cgroup locks inside the read side, so a pending write-lock then only waits for read sections that always run to completion, and no dependency from the rwsem back to cgroup_mutex remains.</p> <p><strong>Affected:</strong> Linux</p> <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>sched_ext: Take cgroup_lock() first in scx_cgroup_lock()</p> <p>scx_cgroup_lock() write-locks scx_cgroup_ops_rwsem and then takes cgroup_lock(), which can deadlock through kernfs:</p> <p>scx enable/disable cgroup rmdir cpu.weight write ------------------ ------------ ---------------- cgroup_lock() percpu_down_write(rwsem) cgroup_lock() kernfs_get_active() percpu_down_read(rwsem) kernfs_drain()</p> <p>The enable path waits for the rmdir to release cgroup_mutex. The rmdir, deactivating the cpu controller&#39;s files, waits in kernfs_drain() for the write&#39;s active reference. The write, in scx_group_set_weight(), waits for the rwsem behind the pending writer.</p> <p>Take cgroup_lock() first. The set_* paths take no cgroup locks inside the read side, so a pending write-lock then only waits for read sections that always run to completion, and no dependency from the rwsem back to cgroup_mutex remains.</p> https://vulnerability.circl.lu/vuln/cve-2026-74593