CVE-2025-39780

What it actually does

The flaw permits invalid task state transitions (such as 0->3) for already-dead tasks during scheduling class switches in sched_ext, skipping necessary initialization checks and emitting kernel warnings from scx_set_task_state.

Why it matters to the business

Systems using custom extended schedulers may experience repeated kernel warnings or instability during scheduler enablement or CPU hotplug events, increasing operational risk and requiring kernel updates that can disrupt workloads until applied.

How an attack unfolds

An attacker or local process triggers sched_ext scheduler enablement via BPF struct_ops while tasks are in transitional or dead states, bypassing dead-task exclusion logic and forcing invalid state transitions that surface as warnings.

How to fix it

Update the Linux kernel to a version containing commit 786f6314604b34c3e7de5f733f4e08e35c448a50 or later; rebuild and deploy the fixed kernel across affected systems.

How to confirm the fix worked

Confirm the running kernel includes commit 786f6314604b34c3e7de5f733f4e08e35c448a50; reproduce the hotplug selftest without triggering the scx_set_task_state warning.

Typical attack path

1. Load or attach a sched_ext BPF scheduler
2. Trigger scheduling class transitions for tasks with zero usage counters
3. Induce repeated enable/disable cycles or CPU hotplug events
4. Observe kernel warnings from invalid state transitions

How to detect it

Search kernel logs for the exact warning string 'Invalid task state transition' combined with 'scx_set_task_state'; inspect BPF and scheduler enablement events around the time of the warning.

• sched_ext: Invalid task state transition
• WARNING: CPU.*scx_set_task_state
• scx_enable_task

What your security team should do

• Prioritize kernel upgrade to the fixed commit on all systems that may load sched_ext schedulers
• Monitor for the specific warning string during scheduler enablement testing
• Restrict unprivileged BPF loading until kernels are updated