CVE-2026-89521

A flaw was found in the Linux kernel's core scheduling component. This issue occurs when the pick_task() function releases the run queue (rq) lock, allowing an interleaving selection to invalidate the scheduler's internal state. This inconsistency can lead to incorrect task selection and skewed resource accounting, potentially affecting system stability or causing a denial of service.

A moderate-severity flaw was found in the Linux kernel's core scheduling component, affecting the kernel shipped in Red Hat Enterprise Linux 10, Red Hat In-Vehicle OS (RHIVOS) 2, and the RHEL CoreOS kernel used by OpenShift Container Platform 5. The scheduler's pick_next_task() selection state is only valid while the run-queue (rq) lock is held continuously, but a ->pick_task() implementation can release that lock. Once the lock is dropped, an interleaving selection can invalidate the derived state: the single-CPU fast path can commit an uncookied pick even though the core became cookied during the release, and forceidle committed by the interleaving selection skews the restarted pass's accounting. A local low-privileged user on an affected system can trigger this race condition, resulting in incorrect task selection and skewed resource accounting that can affect system stability or cause a denial of service. Red Hat rated this flaw Moderate (CVSS 5.5, AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) because exploitation requires local access and only availability is impacted; this is lower than the CVEORG score of 7.3, which additionally credits confidentiality and integrity impacts that the flaw's technical evidence does not support. The vulnerable code is not present in the kernel and kernel-rt packages shipped in Red Hat Enterprise Linux 6, 7, 8, and 9, nor in the RHEL CoreOS kernels used by OpenShift Container Platform 4.12 through 4.23, so those products are not affected. For the affected products, the fix has been deferred to a future update rather than being delivered immediately; until a fixed kernel is released, the residual risk is that a local user could exploit this race to degrade scheduling correctness or cause a denial of service.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.