Description (CNA)
In the Linux kernel, the following vulnerability has been resolved: sched_ext: Skip sub-disable teardown for never-linked sub-schedulers A sub-scheduler enable can fail before scx_link_sched() links the sched into the hierarchy, e.g. when the parent is already being disabled, and cleanup still runs the full scx_sub_disable(). That is racy against root disable: drain_descendants() is the only ordering between a sub's disable-time task walk and root disable's all-task teardown, and an unlinked sub is invisible to it. Root's teardown can thus run between the never-linked sub's drain and its walk, exiting every task to no scheduler. The walk then trips the membership WARN and re-homes the exited tasks onto the dying hierarchy, a use-after-free. Skip the cgroup ownership reset and the task walk if @sch was never linked, indicated by the empty ->sibling as unlinking only happens later in the same function. The membership WARN remains valid: a linked sub is always waited on by an ancestor's drain.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| Linux / Linux | affected 337ec00b1d9c676f637651c2cefddb8612b867ee before 6428093a4a986c38c9089b5eb32b56d914ef437a; affected 337ec00b1d9c676f637651c2cefddb8612b867ee before 8c13364db9c9a43ed286f3a8d0fb9477b1adc43c |
| Linux / Linux | affected 7.1; unaffected 0 before 7.1; unaffected 7.1.9 through 7.1.*; unaffected 7.2 through * |
CWE
No CWE identifiers supplied.