CVE-2026-74593

A flaw was found in the Linux kernel's sched_ext component. An incorrect locking order within the scx_cgroup_lock() function can lead to a deadlock. This occurs when certain cgroup operations, such as enabling/disabling scx or removing a cgroup, happen concurrently with cpu.weight writes. A local attacker could exploit this to cause a system-wide Denial of Service (DoS).

This vulnerability is evaluated as a Moderate severity issue because exploitation requires local access with privileges to alter control group parameters, restricting the blast radius strictly to a denial of service without compromising host data. The locking deadlock specifically involves the BPF extensible scheduling subsystem during concurrent cgroup file operations. Supported Red Hat Enterprise Linux releases are not affected as the sched_ext framework is not incorporated into shipped enterprise kernels.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.