CVE-2026-43392: sched_ext: Fix starvation of scx_enable() under fair-class saturation

Published May 8, 2026
·
Updated

In the Linux kernel, the following vulnerability has been resolved:

schedext: Fix starvation of scxenable() under fair-class saturation

During scxenable(), the READY -> ENABLED task switching loop changes the calling thread's schedclass from fair to ext. Since fair has higher priority than ext, saturating fair-class workloads can indefinitely starve the enable thread, hanging the system. This was introduced when the enable path switched from preemptdisable() to scxbypass() which doesn't protect against fair-class starvation. Note that the original preemptdisable() protection wasn't complete either - in partial switch modes, the calling thread could still be starved after preemptenable() as it may have been switched to ext class.

Fix it by offloading the enable body to a dedicated system-wide RT (SCHEDFIFO) kthread which cannot be starved by either fair or ext class tasks. scxenable() lazily creates the kthread on first use and passes the ops pointer through a struct scxenablecmd containing the kthreadwork, then synchronously waits for completion.

The workfn runs on a different kthread from sch->helper (which runs disablework), so it can safely flush disablework on the error path without deadlock.

Affected Software

13 affected components
Linux Linux kernel
Linux Linux kernel>=6.12.1<6.12.78
Linux Linux kernel>=6.13<6.18.20
Linux Linux kernel>=6.19<6.19.9
Linux Linux kernel=6.12
Linux Linux kernel=6.12-rc2
Linux Linux kernel=6.12-rc3
Linux Linux kernel=6.12-rc4
Linux Linux kernel=6.12-rc5
Linux Linux kernel=6.12-rc6
Linux Linux kernel=6.12-rc7
Linux Linux kernel=7.0-rc1
Linux Linux kernel=7.0-rc2

Event History

May 8, 2026
CVE Published
via MITRE·02:21 PM
Data Sourced
via MITRE·02:21 PM
Description
Data Sourced
via NVD·03:16 PM
RemedyDescriptionSeverityAffected Software

Frequently Asked Questions

1

Under what conditions can this cause a system hang?

Systems using sched_ext are exposed when scx_enable() runs while fair-class workloads saturate scheduling capacity. The issue can indefinitely starve the enabling thread and hang the system.

2

What access and conditions are needed to trigger the issue?

An attacker or local workload needs the ability to create or sustain enough fair-class scheduling load while sched_ext is being enabled. The CVSS vector identifies local access and low privileges, with no user interaction required.

3

What does the available fix change?

Apply one of the available Linux kernel patches referenced in the advisory. The fix moves the enable operation to a dedicated system-wide SCHED_FIFO kernel thread so fair-class and ext-class tasks cannot starve it.

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203