CVE-2025-40260: sched_ext: Fix scx_enable() crash on helper kthread creation failure
In the Linux kernel, the following vulnerability has been resolved:
schedext: Fix scxenable() crash on helper kthread creation failure
A crash was observed when the schedext selftests runner was terminated with Ctrl+\ while test 15 was running:
NIP [c00000000028fa58] scxenable.constprop.0+0x358/0x12b0 LR [c00000000028fa2c] scxenable.constprop.0+0x32c/0x12b0 Call Trace: scxenable.constprop.0+0x32c/0x12b0 (unreliable) bpfstructopslinkcreate+0x18c/0x22c sysbpf+0x23f8/0x3044 sysbpf+0x2c/0x6c systemcallexception+0x124/0x320 systemcallvectoredcommon+0x15c/0x2ec
kthreadrunworker() returns an ERRPTR() on failure rather than NULL, but the current code in scxallocandaddsched() only checks for a NULL helper. Incase of failure on SIGQUIT, the error is not handled in scxallocandaddsched() and scxenable() ends up dereferencing an error pointer.
Error handling is fixed in scxallocandaddsched() to propagate PTRERR() into ret, so that scxenable() jumps to the existing error path, avoiding random dereference on failure.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-40260?
CVE-2025-40260 has been classified as a moderate severity vulnerability.
What is the impact of CVE-2025-40260 on the Linux kernel?
CVE-2025-40260 can cause a crash in the Linux kernel when the sched_ext selftests runner is interrupted.
How do I fix CVE-2025-40260?
Updating to the latest stable version of the Linux kernel will resolve CVE-2025-40260.
Is CVE-2025-40260 exploitable remotely?
CVE-2025-40260 is not classified as a remotely exploitable vulnerability.
What versions of the Linux kernel are affected by CVE-2025-40260?
CVE-2025-40260 affects certain versions of the Linux kernel that include the sched_ext functionality.