CVE-2025-21897

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

sched_ext: Fix pick_task_scx() picking non-queued tasks when it's called without balance()

a6250aa251ea ("sched_ext: Handle cases where pick_task_scx() is called

without preceding balance_scx()") added a workaround to handle the cases

where pick_task_scx() is called without prececing balance_scx() which is due

to a fair class bug where pick_taks_fair() may return NULL after a true

return from balance_fair().

The workaround detects when pick_task_scx() is called without preceding

balance_scx() and emulates SCX_RQ_BAL_KEEP and triggers kicking to avoid

stalling. Unfortunately, the workaround code was testing whether @prev was

on SCX to decide whether to keep the task running. This is incorrect as the

task may be on SCX but no longer runnable.

This could lead to a non-runnable task to be returned from pick_task_scx()

which cause interesting confusions and failures. e.g. A common failure mode

is the task ending up with

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References