CVE-2026-89519: Linux Kernel Privilege Escalation Vulnerability

CVE-2026-89519 Overview

CVE-2026-89519 is a Linux kernel vulnerability in the sched_ext (SCX) subsystem. The flaw involves the SCX_RQ_BAL_KEEP runqueue-level flag, which instructed the scheduler pick path to keep running the previous task. This design is a leftover from when balancing and picking were separate operations. Core scheduling breaks the one-to-one pairing between dispatch and pick, allowing selections to interleave through dispatch lock drops. As a result, a pick can consume a stale flag and keep executing a task that has already been dequeued. The upstream fix replaces the flag with an explicit dispatch verdict returned by scx_dispatch_sched() and balance_one().

Critical Impact
A stale SCX_RQ_BAL_KEEP flag can cause the scheduler to keep running an already-dequeued task under core scheduling, leading to kernel-state inconsistency.

Affected Products

Linux kernel versions containing the sched_ext subsystem with core scheduling enabled
Distributions shipping kernels with SCX before the referenced upstream commits
Systems using custom sched_ext BPF schedulers alongside core scheduling

Discovery Timeline

2026-09-11 - CVE-2026-89519 published to the National Vulnerability Database (NVD)
2026-09-11 - Last updated in NVD database

Technical Details for CVE-2026-89519

Vulnerability Analysis

The sched_ext framework allows scheduling policies to be implemented in BPF. Within its runqueue state, SCX_RQ_BAL_KEEP is a flag set during balancing to indicate that the pick side should keep the previously running task on the CPU. This pattern assumes that each balance decision is immediately consumed by exactly one pick call.

Core scheduling breaks that assumption. It coordinates task selection across sibling CPUs on the same core and drops the runqueue lock during dispatch. During those lock drops, additional selections can interleave. A subsequent pick may then observe the flag set by an earlier, unrelated balance decision and keep a task that has since been dequeued.

Executing a dequeued task from an inconsistent scheduler state can produce use-after-free style behavior on task_struct references, runqueue accounting errors, or scheduler warnings and panics.

Root Cause

The root cause is state coupling through a runqueue-level flag rather than through the decision itself. The SCX_RQ_BAL_KEEP flag persists on the runqueue between operations that are no longer guaranteed to pair up. Under core scheduling, lock drops in the dispatch path allow the flag to be read by a pick that did not originate the balance decision. This is an atomicity and state-tracking flaw in the SCX dispatch and pick interaction.

Attack Vector

Exploitation requires the target kernel to have sched_ext compiled in and an SCX scheduler loaded, together with core scheduling enabled. Triggering the race requires local activity that produces frequent dispatch and pick interleaving on sibling CPUs. The issue is a kernel-side scheduling correctness bug rather than a remote code execution primitive, and the primary observable effects are kernel instability and inconsistent task state on affected CPUs. No public proof-of-concept exploit is available. Full technical context is available in the upstream commits 6f1d3bfe5443 and ffaab58d2175.

// No verified proof-of-concept code is available for CVE-2026-89519.
// See the upstream Linux kernel commits referenced above for the
// authoritative fix and code-level details.

Detection Methods for CVE-2026-89519

Indicators of Compromise

Kernel warnings, BUG: messages, or panics referencing sched_ext, scx_dispatch_sched, balance_one, or pick_task_scx on hosts with core scheduling enabled.
Unexpected scheduling stalls, RCU stalls, or soft lockups on CPUs running an SCX policy.
Task accounting inconsistencies visible via /proc/schedstat or SCX debug interfaces after enabling a custom scheduler.

Detection Strategies

Inventory Linux hosts with CONFIG_SCHED_CLASS_EXT=y and identify which of them enable core scheduling via prctl(PR_SCHED_CORE, ...).
Correlate SCX-related kernel log messages with workload changes and BPF scheduler load events.
Track kernel and distribution advisories referencing commits 6f1d3bfe5443 and ffaab58d2175 to confirm patch coverage.

Monitoring Recommendations

Forward dmesg and journald kernel logs to a centralized log platform and alert on sched_ext and scheduler subsystem messages.
Monitor for unexpected loads of custom SCX BPF programs through audit rules on bpf() syscalls.
Watch host stability metrics on servers using SCX schedulers, including runqueue latency and unexplained CPU stalls.

How to Mitigate CVE-2026-89519

Immediate Actions Required

Apply the upstream Linux kernel commits 6f1d3bfe5443 and ffaab58d2175, or install vendor kernel updates that include them.
Reboot affected systems into the patched kernel to remove the stale-flag code path.
Audit which production systems run sched_ext schedulers and prioritize those with core scheduling enabled.

Patch Information

The fix replaces SCX_RQ_BAL_KEEP with an explicit dispatch verdict returned by scx_dispatch_sched() and balance_one(), tying the keep-running decision to the dispatch that produced it. It also factors the pick-side invocation, follow-up queueing, and post-dispatch checks out of do_pick_task_scx() into a new dispatch_pick() helper. The SCX_RQ_BAL_KEEP plumbing is removed from the tools autogen enum headers. No functional changes outside the core scheduling correctness fix are intended.

Workarounds

Where patching is delayed, unload custom SCX BPF schedulers and fall back to the default in-kernel scheduler.
Disable core scheduling on affected hosts by not invoking PR_SCHED_CORE for workloads that require SMT isolation, accepting the resulting security trade-off.
Restrict CAP_BPF and CAP_SYS_ADMIN so unprivileged users cannot load sched_ext programs on production kernels.

bash

# Confirm kernel version and sched_ext support
uname -r
grep -E 'CONFIG_SCHED_CLASS_EXT' /boot/config-$(uname -r)

# List currently loaded BPF programs (identify SCX schedulers)
bpftool prog show | grep -i sched