{ "dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": { "cveId": "CVE-2025-39780", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2025-04-16T07:20:57.130Z", "datePublished": "2025-09-11T16:56:31.142Z", "dateUpdated": "2026-08-05T12:05:05.360Z" }, "containers": { "cna": { "providerMetadata": { "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T12:05:05.360Z" }, "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nsched/ext: Fix invalid task state transitions on class switch\n\nWhen enabling a sched_ext scheduler, we may trigger invalid task state\ntransitions, resulting in warnings like the following (which can be\neasily reproduced by running the hotplug selftest in a loop):\n\n sched_ext: Invalid task state transition 0 -> 3 for fish[770]\n WARNING: CPU: 18 PID: 787 at kernel/sched/ext.c:3862 scx_set_task_state+0x7c/0xc0\n ...\n RIP: 0010:scx_set_task_state+0x7c/0xc0\n ...\n Call Trace:\n \n scx_enable_task+0x11f/0x2e0\n switching_to_scx+0x24/0x110\n scx_enable.isra.0+0xd14/0x13d0\n bpf_struct_ops_link_create+0x136/0x1a0\n __sys_bpf+0x1edd/0x2c30\n __x64_sys_bpf+0x21/0x30\n do_syscall_64+0xbb/0x370\n entry_SYSCALL_64_after_hwframe+0x77/0x7f\n\nThis happens because we skip initialization for tasks that are already\ndead (with their usage counter set to zero), but we don't exclude them\nduring the scheduling class transition phase.\n\nFix this by also skipping dead tasks during class swiching, preventing\ninvalid task state transitions." } ], "metrics": [ { "cvssV3_1": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH" }, "scenarios": [ { "lang": "en", "value": "AV:L - The vulnerable path is entered through the local `bpf(BPF_LINK_CREATE)` syscall attaching a sched_ext struct_ops scheduler, combined with local task fork/exit churn to populate the race window. No network-reachable code is involved.\nAC:L - The attacker controls both sides of the race — generating a storm of exiting tasks (each of which sits on `scx_tasks` with `usage == 0` for a full RCU grace period, since `put_task_struct()` always defers via `call_rcu()`) while repeatedly enabling a scheduler; upstream states it is \"easily reproduced by running the hotplug selftest in a loop\".\nPR:L - Enabling a sched_ext scheduler needs only `bpf_token_capable(CAP_BPF)`, which is delegable to unprivileged users in user namespaces via BPF tokens (and is open on `unprivileged_bpf_disabled=0` systems); on deployments where a daemon such as scx_loader switches schedulers, a wholly unprivileged user supplies the dying-task half of the race.\nUI:N - The entire sequence — scheduler attach plus fork/exit churn — is driven by the attacker's own processes. No victim action is required.\nS:U - The corruption is confined to kernel scheduler state within the same security authority; no VM, IOMMU, or sandbox boundary is crossed.\nC:H - The code reads and writes a `task_struct` whose usage refcount has already reached zero and which is queued for RCU-deferred destruction — the exact condition the `Fixes:` commit identifies as a use-after-free hazard — and drives BPF `ops.enable()`/`ops.exit_task()` against a task with no allocated per-task context, exposing stale/foreign scheduler state.\nI:H - `p->sched_class` (a pointer to the scheduling-class function-pointer dispatch table), `p->scx.slice`, and `p->scx.flags` are written into an object that is mid-teardown and pending free, and the sched_ext task state machine is forced through an illegal `NONE -> ENABLED` transition that corrupts BPF-scheduler per-task accounting.\nA:H - The bug triggers a `WARN_ONCE()` splat in `scx_set_task_state()`, which is an immediate kernel panic on the many hardened, cloud, Android, and CI configurations that set `panic_on_warn`; additionally the resulting contract violation makes real BPF schedulers call `scx_bpf_error()`, ejecting the scheduler and disrupting scheduling system-wide." } ] } ], "affected": [ { "product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "kernel/sched/ext.c" ], "versions": [ { "version": "a8532fac7b5d27b8d62008a89593dccb6f9786ef", "lessThan": "786f6314604b34c3e7de5f733f4e08e35c448a50", "status": "affected", "versionType": "git" }, { "version": "a8532fac7b5d27b8d62008a89593dccb6f9786ef", "lessThan": "6a32cbe95029ebe21cc08349fd7ef2a3d32d2043", "status": "affected", "versionType": "git" }, { "version": "a8532fac7b5d27b8d62008a89593dccb6f9786ef", "lessThan": "ddf7233fcab6c247379d0928d46cc316ee122229", "status": "affected", "versionType": "git" } ] }, { "product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "kernel/sched/ext.c" ], "versions": [ { "version": "6.12", "status": "affected" }, { "version": "0", "lessThan": "6.12", "status": "unaffected", "versionType": "semver" }, { "version": "6.12.44", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.16.4", "lessThanOrEqual": "6.16.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.17", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix" } ] } ], "cpeApplicability": [ { "nodes": [ { "operator": "OR", "negate": false, "cpeMatch": [ { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.12", "versionEndExcluding": "6.12.44" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.12", "versionEndExcluding": "6.16.4" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.12", "versionEndExcluding": "6.17" } ] } ] } ], "references": [ { "url": "https://git.kernel.org/stable/c/786f6314604b34c3e7de5f733f4e08e35c448a50" }, { "url": "https://git.kernel.org/stable/c/6a32cbe95029ebe21cc08349fd7ef2a3d32d2043" }, { "url": "https://git.kernel.org/stable/c/ddf7233fcab6c247379d0928d46cc316ee122229" } ], "title": "sched/ext: Fix invalid task state transitions on class switch", "x_generator": { "engine": "bippy-1.2.0" } } } }