CVE-2026-98418: sched/core: Avoid false migration warning for proxy donors
In the Linux kernel, the following vulnerability has been resolved:
sched/core: Avoid false migration warning for proxy donors
Proxy execution can move a blocked donor's scheduling context to the lock owner's CPU even when the donor is migration-disabled. The donor does not execute there, and its original execution CPU remains recorded in wakecpu.
settaskcpu() warns unconditionally for migration-disabled tasks, so a subsequent proxy migration or the wakeup path returning the donor home triggers a false positive: moving a blocked scheduling context does not violate the migration-disabled execution context.
For example, creating a mutex owner on CPU1 and a migration-disabled waiter on CPU0 can trigger the following warning:
proxymigraterepro: donor blocking on CPU0 with migration disabled proxymigraterepro: donor moved from CPU0 to CPU1 WARNING: kernel/sched/core.c:3389 at settaskcpu+0x1d3/0x280 ... Call Trace: trytowakeup+0x43f/0x780 mutexunlockslowpath+0x330/0x540 ownerfn+0x9f/0xc0 [proxymigraterepro] ... proxymigraterepro: donor woke on CPU0, taskcpu=0 proxymigraterepro: completed
Exclude blocked proxy donors from the warning. The proxy wakeup path restores an executable placement before clearing the blocked state.
Affected Software
Event History
Frequently Asked Questions
When can this warning be triggered?
It can occur when proxy execution moves a blocked, migration-disabled donor's scheduling context to a mutex lock owner's CPU. A demonstrated setup uses a mutex owner on one CPU and a migration-disabled waiter on another CPU.
Does the warning mean the migration-disabled task executed on the other CPU?
No. The donor does not execute on the other CPU; only its blocked scheduling context is moved for proxy execution. Its original execution CPU remains recorded in wake_cpu, and the proxy wakeup path restores it home.
What is the impact of this issue?
The issue is a false-positive scheduler warning from set_task_cpu(). The described behavior does not violate the migration-disabled execution context.