Cloudanix VulnDB

CVE-2026-68421

None

CVSS

—

EPSS

0.2%

Published

Aug 10, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

An operating system scheduling bug could generate confusing error messages when certain security multitasking features are active, making it harder for administrators to spot real problems.

Exploitation
Other
Attacker needs
Other
Complexity
Theoretical
Impact
Other
Component
OS kernel
Class
Other
Remediation
Patch
Effort
Medium
Patch risk
Low

What it actually does

Incorrect warning triggered in put_prev_task_scx when core scheduling forces an SMT sibling idle via the core_pick fast path, bypassing balance_one and allowing a runnable SCX task to drop classes without SCX_OPS_ENQ_LAST.

Why it matters to the business

Produces noisy kernel logs that can obscure genuine scheduler problems, increasing operational overhead for teams running core-scheduling workloads on recent kernels.

How an attack unfolds

An attacker with local execution can enable core scheduling and arrange SMT sibling forced-idle conditions to trigger the spurious warning; no privilege escalation or code execution results.

How to fix it

Upgrade to a kernel containing the sched_ext fix that gates the warning on sched_cpu_cookie_match; no configuration changes are required.

How to confirm the fix worked

Confirm the patch is present by checking the sched_ext source for the sched_cpu_cookie_match guard around the ENQ_LAST warning; reproduce core-scheduling forced-idle workloads and verify the warning no longer appears.

Typical attack path

  1. Obtain local unprivileged access on an affected kernel
  2. Enable core scheduling on the system
  3. Create workload patterns that force SMT sibling idle via core_pick
  4. Observe the warning emitted from put_prev_task_scx

How to detect it

Search kernel logs and dmesg for the original put_prev_task_scx warning text on systems that have core scheduling enabled; no network or file artifacts are produced.

What your security team should do

  • Apply the sched_ext warning fix during the next kernel update cycle
  • Monitor kernel logs for the original warning string as a temporary detection measure
  • Prioritize systems using core scheduling or sched_ext for earlier patching

The record

In the Linux kernel, the following vulnerability has been resolved: sched_ext: Don't warn on core-sched forced idle in put_prev_task_scx() put_prev_task_scx() warns when a runnable task drops to a lower sched_class without SCX_OPS_ENQ_LAST, on the assumption that balance_one() would have kept it running. Core scheduling breaks that: a forced-idle SMT sibling reschedules through the core_pick fast path in pick_next_task(), which skips pick_task_scx() and thus balance_one(), so a runnable task can drop to idle with ENQ_LAST unset. Gate the warning on sched_cpu_cookie_match(): a cookie mismatch means core scheduling forced the idle, while a match (or core scheduling off) still catches a genuine missing-ENQ_LAST drop.

Affected packages

Ecosystem Package Introduced Fixed