CVE-2026-53328

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

sched_ext: Don't warn on NULL cgrp_moving_from in scx_cgroup_move_task()

A WARN fires when systemd's user manager writes "+cpu +memory +pids" to

its own subtree_control while a sched_ext scheduler is loaded:

WARNING: at kernel/sched/ext.c:3227 scx_cgroup_move_task+0xa8/0xb0

scx_cgroup_move_task+0xa8/0xb0

sched_move_task+0x134/0x290

cpu_cgroup_attach+0x39/0x70

cgroup_migrate_execute+0x37d/0x450

cgroup_update_dfl_csses+0x1e3/0x270

cgroup_subtree_control_write+0x3e7/0x440

scx_cgroup_can_attach() arms cgrp_moving_from only when a task's cpu

cgroup changes. It can still be NULL when scx_cgroup_move_task() runs,

through this sequence:

Step Result

--------------------------------- ----------------------------------

1. cpu enabled on cgroup G cpu css = A

2. cpu toggled off then on for G A killed, B created (same cgroup)

3. an exiting task keeps A alive

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References