CVE-2024-57891

What it actually does

Incorrect IRQ restore in scx_ops_bypass() due to stray rq_unlock_irqrestore() call that can re-enable interrupts prematurely, triggering warnings and leaving the kernel in an inconsistent IRQ state during sched_ext enablement.

Why it matters to the business

May cause kernel warnings, scheduling instability, or unexpected behavior on systems using sched_ext; low immediate risk but requires patching to maintain kernel reliability, especially on affected Ubuntu releases with high ecosystem prevalence.

How an attack unfolds

An attacker or administrator triggers sched_ext registration (bpf_scx_reg) which calls scx_ops_enable and then scx_ops_bypass; the mismatched locking path executes warn_bogus_irq_restore, exposing the race but not providing direct code execution or privilege escalation in known scenarios.

How to fix it

Update to fixed kernel versions that correct the locking in scx_ops_bypass; for listed Ubuntu packages apply imagemagick updates where applicable or kernel patches addressing sched_ext (exact fixed versions: 8:6.7.7.10-6ubuntu3.11 for 14.04 LTS and 8:6.8.9.9-7ubuntu5.11 for 16.04 LTS).

How to confirm the fix worked

Confirm absence of the warn_bogus_irq_restore call trace during scx_ops_enable; verify updated packages are installed and test sched_ext enablement without IRQ warnings.

Typical attack path

1. Load or register a sched_ext BPF program
2. Invoke scx_ops_enable.isra.0 which calls scx_ops_bypass
3. Hit the inner rq_unlock_irqrestore path with IRQs already enabled
4. Trigger the warning and potential IRQ state corruption

How to detect it

Search kernel logs for warn_bogus_irq_restore or scx_ops_bypass call traces; inspect for IRQ flag debug warnings during BPF sched_ext registration events.

What your security team should do

• Apply kernel or package updates immediately given published date and days since disclosure
• Monitor for sched_ext usage in production workloads
• Review logs for raw_local_irq_restore warnings post-deployment