CVE-2026-43392: sched_ext: Fix starvation of scx_enable() under fair-class saturation
In the Linux kernel, the following vulnerability has been resolved:
schedext: Fix starvation of scxenable() under fair-class saturation
During scxenable(), the READY -> ENABLED task switching loop changes the calling thread's schedclass from fair to ext. Since fair has higher priority than ext, saturating fair-class workloads can indefinitely starve the enable thread, hanging the system. This was introduced when the enable path switched from preemptdisable() to scxbypass() which doesn't protect against fair-class starvation. Note that the original preemptdisable() protection wasn't complete either - in partial switch modes, the calling thread could still be starved after preemptenable() as it may have been switched to ext class.
Fix it by offloading the enable body to a dedicated system-wide RT (SCHEDFIFO) kthread which cannot be starved by either fair or ext class tasks. scxenable() lazily creates the kthread on first use and passes the ops pointer through a struct scxenablecmd containing the kthreadwork, then synchronously waits for completion.
The workfn runs on a different kthread from sch->helper (which runs disablework), so it can safely flush disablework on the error path without deadlock.
Affected Software
Remediation
Event History
Frequently Asked Questions
Under what conditions can this cause a system hang?
Systems using sched_ext are exposed when scx_enable() runs while fair-class workloads saturate scheduling capacity. The issue can indefinitely starve the enabling thread and hang the system.
What access and conditions are needed to trigger the issue?
An attacker or local workload needs the ability to create or sustain enough fair-class scheduling load while sched_ext is being enabled. The CVSS vector identifies local access and low privileges, with no user interaction required.
What does the available fix change?
Apply one of the available Linux kernel patches referenced in the advisory. The fix moves the enable operation to a dedicated system-wide SCHED_FIFO kernel thread so fair-class and ext-class tasks cannot starve it.