CVE-2025-21965

In the Linux kernel, the following vulnerability has been resolved:

sched_ext: Validate prev_cpu in scx_bpf_select_cpu_dfl()

If a BPF scheduler provides an invalid CPU (outside the nr_cpu_ids range) as prev_cpu to scx_bpf_select_cpu_dfl() it can cause a kernel crash.

To prevent this, validate prev_cpu in scx_bpf_select_cpu_dfl() and trigger an scx error if an invalid CPU is specified.

This vulnerability does not affect supported Red Hat Enterprise Linux releases because the extensible scheduler framework (sched_ext) is not included in enterprise kernel builds. On vulnerable upstream systems, exploitation requires privileges to load custom BPF schedulers, potentially resulting in a local denial of service through a kernel crash. Because the affected subsystem was only introduced in newer upstream kernels, Red Hat enterprise products are not exposed to this flaw.