CVE-2026-93220: sched_ext: Keep kick_sync waiting on the rq's own CPU

Published Sep 24, 2026
·
Updated

In the Linux kernel, the following vulnerability has been resolved:

schedext: Keep kicksync waiting on the rq's own CPU

kicksyncwaitbalcb() assumes it runs on the rq's CPU from the schedule() tail: the snapshots it compares against live in that CPU's percpu area and the busy-wait runs with the rq lock dropped and IRQs enabled.

However, dispatch can now drop the rq lock while the callback sits queued, and rq lock takers in that window (the sched class change paths, the scx task iterator) flush pending balance callbacks on release, running the callback on a foreign CPU. Such a run compares against unrelated snapshots and can deadlock when the executing CPU is itself a wait target.

Bail on a foreign CPU and leave the wait state alone. The wait only observes progress that the resched kicks already guarantee and the rq's next wait picks up the stale cpustosync bits.

Affected Software

1 affected component
Linux Linux kernel

Event History

Sep 24, 2026
CVE Published
via MITRE·03:10 PM
Data Sourced
via MITRE·03:10 PM
Description
Data Sourced
via NVD·04:17 PM
Description

Frequently Asked Questions

1

What conditions are required for this issue to occur?

The affected path involves sched_ext kick_sync waiting, a queued balance callback, and the runqueue lock being dropped before that callback runs. A scheduler class change path or the scx task iterator can then flush the pending callback on a CPU other than the runqueue's own CPU.

2

What is the practical impact if the callback runs on a foreign CPU?

It can compare per-CPU snapshots belonging to an unrelated CPU. If the CPU executing the callback is itself a wait target, the busy-wait can deadlock.

3

Is there a mitigation described for systems that cannot immediately apply the fix?

No operational workaround is provided in the available data. The described resolution is to bail out when the callback is running on a foreign CPU while preserving the wait state for the runqueue's next wait.

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203