GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

FKIE_CVE-2026-68421

Vulnerability from fkie_nvd - Published: 2026-08-10 13:20 - Updated: 2026-08-17 06:17
Severity
Summary
In the Linux kernel, the following vulnerability has been resolved: sched_ext: Don't warn on core-sched forced idle in put_prev_task_scx() put_prev_task_scx() warns when a runnable task drops to a lower sched_class without SCX_OPS_ENQ_LAST, on the assumption that balance_one() would have kept it running. Core scheduling breaks that: a forced-idle SMT sibling reschedules through the core_pick fast path in pick_next_task(), which skips pick_task_scx() and thus balance_one(), so a runnable task can drop to idle with ENQ_LAST unset. Gate the warning on sched_cpu_cookie_match(): a cookie mismatch means core scheduling forced the idle, while a match (or core scheduling off) still catches a genuine missing-ENQ_LAST drop.
References
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/2907e9d0f05b506dfd58aec589a23042a56ef36b
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/b7d9c359e5cf867f7eb23df3bb1c6b9e58af24da
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/e2f188cdbf8312289532c36eb4e9eb1c9544d43a
Impacted products
Vendor Product Version
To clipboard 

{
  "affected": [
    {
      "affectedData": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "kernel/sched/ext/ext.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "2907e9d0f05b506dfd58aec589a23042a56ef36b",
              "status": "affected",
              "version": "7c65ae81ea86a6ed8086e1a5651acd766187f19b",
              "versionType": "git"
            },
            {
              "lessThan": "e2f188cdbf8312289532c36eb4e9eb1c9544d43a",
              "status": "affected",
              "version": "7c65ae81ea86a6ed8086e1a5651acd766187f19b",
              "versionType": "git"
            },
            {
              "lessThan": "b7d9c359e5cf867f7eb23df3bb1c6b9e58af24da",
              "status": "affected",
              "version": "7c65ae81ea86a6ed8086e1a5651acd766187f19b",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "kernel/sched/ext/ext.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.12"
            },
            {
              "lessThan": "6.12",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.42",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.6",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nsched_ext: Don\u0027t warn on core-sched forced idle in put_prev_task_scx()\n\nput_prev_task_scx() warns when a runnable task drops to a lower sched_class\nwithout SCX_OPS_ENQ_LAST, on the assumption that balance_one() would have\nkept it running. Core scheduling breaks that: a forced-idle SMT sibling\nreschedules through the core_pick fast path in pick_next_task(), which skips\npick_task_scx() and thus balance_one(), so a runnable task can drop to idle\nwith ENQ_LAST unset.\n\nGate the warning on sched_cpu_cookie_match(): a cookie mismatch means core\nscheduling forced the idle, while a match (or core scheduling off) still\ncatches a genuine missing-ENQ_LAST drop."
    }
  ],
  "id": "CVE-2026-68421",
  "lastModified": "2026-08-17T06:17:51.153",
  "metrics": {},
  "published": "2026-08-10T13:20:35.980",
  "references": [
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/2907e9d0f05b506dfd58aec589a23042a56ef36b"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/b7d9c359e5cf867f7eb23df3bb1c6b9e58af24da"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/e2f188cdbf8312289532c36eb4e9eb1c9544d43a"
    }
  ],
  "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
  "vulnStatus": "Received"
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.