CVE-2026-31733

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

sched_ext: Fix stale direct dispatch state in ddsp_dsq_id

@p->scx.ddsp_dsq_id can be left set (non-SCX_DSQ_INVALID) triggering a

spurious warning in mark_direct_dispatch() when the next wakeup's

ops.select_cpu() calls scx_bpf_dsq_insert(), such as:

WARNING: kernel/sched/ext.c:1273 at scx_dsq_insert_commit+0xcd/0x140

The root cause is that ddsp_dsq_id was only cleared in dispatch_enqueue(),

which is not reached in all paths that consume or cancel a direct dispatch

verdict.

Fix it by clearing it at the right places:

- direct_dispatch(): cache the direct dispatch state in local variables

and clear it before dispatch_enqueue() on the synchronous path. For

the deferred path, the direct dispatch state must remain set until

process_ddsp_deferred_locals() consumes them.

- process_ddsp_deferred_locals(): cache the dispatch state in local

variables and clear it before calling dispatch_to_local_dsq(), which

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References