CVE-2026-74593: sched_ext: Take cgroup_lock() first in scx_cgroup_lock()

In the Linux kernel, the following vulnerability has been resolved:

schedext: Take cgrouplock() first in scxcgrouplock()

scxcgrouplock() write-locks scxcgroupopsrwsem and then takes cgrouplock(), which can deadlock through kernfs:

scx enable/disable cgroup rmdir cpu.weight write ------------------ ------------ ---------------- cgrouplock() percpudownwrite(rwsem) cgrouplock() kernfsgetactive() percpudownread(rwsem) kernfsdrain()

The enable path waits for the rmdir to release cgroupmutex. The rmdir, deactivating the cpu controller's files, waits in kernfsdrain() for the write's active reference. The write, in scxgroupsetweight(), waits for the rwsem behind the pending writer.

Take cgrouplock() first. The set paths take no cgroup locks inside the read side, so a pending write-lock then only waits for read sections that always run to completion, and no dependency from the rwsem back to cgroupmutex remains.