CVE-2026-31733: Linux Kernel Privilege Escalation Flaw

CVE-2026-31733 Overview

CVE-2026-31733 is a Linux kernel vulnerability in the sched_ext (SCX) extensible scheduler subsystem. The flaw involves stale direct dispatch state in the ddsp_dsq_id field of the scheduler extension task structure. The @p->scx.ddsp_dsq_id value can remain non-SCX_DSQ_INVALID across paths that do not reach dispatch_enqueue(), triggering a spurious WARN_ON_ONCE() in mark_direct_dispatch() on the next wakeup. The issue affects Linux kernel versions including 7.0-rc1 through 7.0-rc6. Local low-privileged users can trigger the warning, resulting in availability impact on systems running BPF-based scheduler extensions.

Critical Impact
A local authenticated user can trigger a kernel warning and induce scheduler instability on systems using sched_ext BPF schedulers, leading to denial of service.

Affected Products

Linux Kernel (multiple stable branches)
Linux Kernel 7.0-rc1 through 7.0-rc6
Systems running BPF-based sched_ext schedulers with SCX_OPS_ALLOW_QUEUED_WAKEUP

Discovery Timeline

2026-05-01 - CVE-2026-31733 published to NVD
2026-05-07 - Last updated in NVD database

Technical Details for CVE-2026-31733

Vulnerability Analysis

The vulnerability resides in the Linux kernel's sched_ext subsystem at kernel/sched/ext.c:1273. The ddsp_dsq_id task field tracks pending direct dispatch verdicts produced by a BPF scheduler's ops.select_cpu() callback. The original code only cleared this field inside dispatch_enqueue(). Several code paths consume or cancel a direct dispatch verdict without reaching that function, leaving the field in a stale state. On the next wakeup, when ops.select_cpu() calls scx_bpf_dsq_insert(), the stale value triggers WARN_ON_ONCE() in mark_direct_dispatch(), producing kernel log noise and indicating broken scheduler invariants.

Root Cause

The root cause is incomplete state tracking for the direct dispatch verdict in sched_ext. The ddsp_dsq_id field was cleared in only one location, while task lifecycle paths including local, global, and bypass enqueue fallbacks, deferred dispatch cancellation, the holding_cpu race, and scheduler transitions can each consume or invalidate the verdict without resetting the field. This represents an improper state management defect [CWE-noinfo].

Attack Vector

Exploitation requires local access with low privileges on a system running a BPF sched_ext scheduler. A local user can craft workloads that trigger wake-list queuing through ttwu_queue_wakelist() when SCX_OPS_ALLOW_QUEUED_WAKEUP is enabled. Tasks placed on a wake_list bypass the runqueue iteration in scx_bypass(), leaving stale ddsp_dsq_id values intact across scheduler transitions. The next direct dispatch attempt triggers the warning and can destabilize scheduler accounting. The vulnerability does not yield code execution or information disclosure but produces availability impact.

The upstream fix clears ddsp_dsq_id at the correct points: direct_dispatch(), process_ddsp_deferred_locals(), do_enqueue_task(), dequeue_task_scx(), and scx_disable_task(). See the kernel commit ca685511 for the patch implementation.

Detection Methods for CVE-2026-31733

Indicators of Compromise

Kernel log entries containing WARNING: kernel/sched/ext.c:1273 at scx_dsq_insert_commit
Repeated WARN_ON_ONCE() traces in mark_direct_dispatch() after BPF scheduler load or replacement
Stack traces referencing scx_bpf_dsq_insert and ops.select_cpu callbacks in dmesg

Detection Strategies

Monitor dmesg and /var/log/kern.log for warnings emitted from kernel/sched/ext.c line 1273.
Audit running kernels and identify hosts with CONFIG_SCHED_CLASS_EXT=y and active BPF schedulers via cat /sys/kernel/sched_ext/state.
Inventory kernel versions across the fleet and flag systems running affected stable branches or 7.0-rc series builds.

Monitoring Recommendations

Forward kernel ring buffer events to a centralized logging pipeline and alert on scx_dsq_insert_commit or mark_direct_dispatch warnings.
Track BPF program loads targeting the sched_ext class, particularly schedulers setting SCX_OPS_ALLOW_QUEUED_WAKEUP.
Correlate scheduler warnings with workload anomalies such as latency spikes or CPU stalls on affected hosts.

How to Mitigate CVE-2026-31733

Immediate Actions Required

Apply the upstream Linux kernel patches referenced in the vendor advisories and reboot affected systems.
Restrict CAP_BPF and CAP_SYS_ADMIN to trusted users to limit who can load sched_ext BPF schedulers.
Audit any custom BPF schedulers in production for use of SCX_OPS_ALLOW_QUEUED_WAKEUP and validate dispatch verdict handling.

Patch Information

The Linux kernel maintainers released fixes across multiple stable branches. Patched commits include 5e7b2cc8, 7e0ffb72, 7ea601da, and ca685511. Update to a kernel version that includes these patches and verify by inspecting the kernel/sched/ext.c file for the new clearing logic.

Workarounds

Disable sched_ext by booting with kernels compiled without CONFIG_SCHED_CLASS_EXT until patches can be applied.
Unload any active BPF sched_ext scheduler using bpftool struct_ops unregister to fall back to the default CFS/EEVDF scheduler.
Avoid setting the SCX_OPS_ALLOW_QUEUED_WAKEUP flag in custom schedulers on unpatched kernels.

bash

# Verify kernel version and sched_ext status
uname -r
cat /sys/kernel/sched_ext/state 2>/dev/null || echo "sched_ext not active"

# List loaded sched_ext BPF programs
bpftool struct_ops list | grep sched_ext

# Unload an active sched_ext scheduler (replace ID)
bpftool struct_ops unregister id <ID>