CVE-2026-31733

{"id": "CVE-2026-31733", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.5, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 1.8}]}, "affected": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "affectedData": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "5b26f7b920f76b2b9cc398c252a9e35e44bf5bb9", "lessThan": "ca685511f7afd42cdcbb0feea42e5d332d384251", "versionType": "git"}, {"status": "affected", "version": "5b26f7b920f76b2b9cc398c252a9e35e44bf5bb9", "lessThan": "5e7b2cc8fae9ec2a5bc53311191d2faaff75a4b5", "versionType": "git"}, {"status": "affected", "version": "5b26f7b920f76b2b9cc398c252a9e35e44bf5bb9", "lessThan": "7ea601daa0153e19cd1c6e6b300348c70c05fe77", "versionType": "git"}, {"status": "affected", "version": "5b26f7b920f76b2b9cc398c252a9e35e44bf5bb9", "lessThan": "7e0ffb72de8aa3b25989c2d980e81b829c577010", "versionType": "git"}], "programFiles": ["kernel/sched/ext.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "6.12"}, {"status": "unaffected", "version": "0", "lessThan": "6.12", "versionType": "semver"}, {"status": "unaffected", "version": "6.12.82", "versionType": "semver", "lessThanOrEqual": "6.12.*"}, {"status": "unaffected", "version": "6.18.22", "versionType": "semver", "lessThanOrEqual": "6.18.*"}, {"status": "unaffected", "version": "6.19.12", "versionType": "semver", "lessThanOrEqual": "6.19.*"}, {"status": "unaffected", "version": "7.0", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["kernel/sched/ext.c"], "defaultStatus": "affected"}]}], "published": "2026-05-01T15:16:35.913", "references": [{"url": "https://git.kernel.org/stable/c/5e7b2cc8fae9ec2a5bc53311191d2faaff75a4b5", "tags": ["Patch"], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/7e0ffb72de8aa3b25989c2d980e81b829c577010", "tags": ["Patch"], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/7ea601daa0153e19cd1c6e6b300348c70c05fe77", "tags": ["Patch"], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/ca685511f7afd42cdcbb0feea42e5d332d384251", "tags": ["Patch"], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "NVD-CWE-noinfo"}]}], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nsched_ext: Fix stale direct dispatch state in ddsp_dsq_id\n\n@p->scx.ddsp_dsq_id can be left set (non-SCX_DSQ_INVALID) triggering a\nspurious warning in mark_direct_dispatch() when the next wakeup's\nops.select_cpu() calls scx_bpf_dsq_insert(), such as:\n\n WARNING: kernel/sched/ext.c:1273 at scx_dsq_insert_commit+0xcd/0x140\n\nThe root cause is that ddsp_dsq_id was only cleared in dispatch_enqueue(),\nwhich is not reached in all paths that consume or cancel a direct dispatch\nverdict.\n\nFix it by clearing it at the right places:\n\n - direct_dispatch(): cache the direct dispatch state in local variables\n and clear it before dispatch_enqueue() on the synchronous path. For\n the deferred path, the direct dispatch state must remain set until\n process_ddsp_deferred_locals() consumes them.\n\n - process_ddsp_deferred_locals(): cache the dispatch state in local\n variables and clear it before calling dispatch_to_local_dsq(), which\n may migrate the task to another rq.\n\n - do_enqueue_task(): clear the dispatch state on the enqueue path\n (local/global/bypass fallbacks), where the direct dispatch verdict is\n ignored.\n\n - dequeue_task_scx(): clear the dispatch state after dispatch_dequeue()\n to handle both the deferred dispatch cancellation and the holding_cpu\n race, covering all cases where a pending direct dispatch is\n cancelled.\n\n - scx_disable_task(): clear the direct dispatch state when\n transitioning a task out of the current scheduler. Waking tasks may\n have had the direct dispatch state set by the outgoing scheduler's\n ops.select_cpu() and then been queued on a wake_list via\n ttwu_queue_wakelist(), when SCX_OPS_ALLOW_QUEUED_WAKEUP is set. Such\n tasks are not on the runqueue and are not iterated by scx_bypass(),\n so their direct dispatch state won't be cleared. Without this clear,\n any subsequent SCX scheduler that tries to direct dispatch the task\n will trigger the WARN_ON_ONCE() in mark_direct_dispatch()."}, {"lang": "es", "value": "En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nsched_ext: Corrige el estado obsoleto de despacho directo en ddsp_dsq_id\n\n@p -> scx.ddsp_dsq_id puede quedar establecido (no-SCX_DSQ_INVALID) desencadenando una advertencia espuria en mark_direct_dispatch() cuando el ops.select_cpu() de la siguiente activaci\u00f3n llama a scx_bpf_dsq_insert(), como por ejemplo:\n\n ADVERTENCIA: kernel/sched/ext.c:1273 en scx_dsq_insert_commit+0xcd/0x140\n\nLa causa ra\u00edz es que ddsp_dsq_id solo se borraba en dispatch_enqueue(), que no se alcanza en todas las rutas que consumen o cancelan un veredicto de despacho directo.\n\nCorr\u00edgelo borr\u00e1ndolo en los lugares correctos:\n\n - direct_dispatch(): almacena en cach\u00e9 el estado de despacho directo en variables locales y b\u00f3rralo antes de dispatch_enqueue() en la ruta s\u00edncrona. Para la ruta diferida, el estado de despacho directo debe permanecer establecido hasta que process_ddsp_deferred_locals() los consuma.\n\n - process_ddsp_deferred_locals(): almacena en cach\u00e9 el estado de despacho en variables locales y b\u00f3rralo antes de llamar a dispatch_to_local_dsq(), lo que puede migrar la tarea a otra rq.\n\n - do_enqueue_task(): borra el estado de despacho en la ruta de encolamiento (alternativas local/global/bypass), donde el veredicto de despacho directo es ignorado.\n\n - dequeue_task_scx(): borra el estado de despacho despu\u00e9s de dispatch_dequeue() para manejar tanto la cancelaci\u00f3n de despacho diferido como la condici\u00f3n de carrera holding_cpu, cubriendo todos los casos en los que se cancela un despacho directo pendiente.\n\n - scx_disable_task(): borra el estado de despacho directo al hacer la transici\u00f3n de una tarea fuera del planificador actual. Las tareas que se activan pueden haber tenido el estado de despacho directo establecido por el ops.select_cpu() del planificador saliente y luego haber sido encoladas en una wake_list a trav\u00e9s de ttwu_queue_wakelist(), cuando SCX_OPS_ALLOW_QUEUED_WAKEUP est\u00e1 establecido. Dichas tareas no est\u00e1n en la runqueue y no son iteradas por scx_bypass(), por lo que su estado de despacho directo no se borrar\u00e1. Sin este borrado, cualquier planificador SCX subsiguiente que intente despachar directamente la tarea activar\u00e1 el WARN_ON_ONCE() en mark_direct_dispatch()."}], "lastModified": "2026-11-11T21:10:00.200", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "12ED4499-597C-42BD-BD53-014753EC3EB0", "versionEndExcluding": "6.12.82", "versionStartIncluding": "6.12"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "C9DF8BCE-36D3-475D-9D21-19E4F02F9029", "versionEndExcluding": "6.18.22", "versionStartIncluding": "6.13"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "0A2B9540-02D5-41B4-B16A-82AF66FD4F36", "versionEndExcluding": "6.19.12", "versionStartIncluding": "6.19"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "F253B622-8837-4245-BCE5-A7BF8FC76A16"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "F666C8D8-6538-46D4-B318-87610DE64C34"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "02259FDA-961B-47BC-AE7F-93D7EC6E90C2"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "58A9FEFF-C040-420D-8F0A-BFDAAA1DF258"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "1D2315C0-D46F-4F85-9754-F9E5E11374A6"}], "operator": "OR"}]}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}