CVE-2025-39780

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-39780", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2025-04-16T07:20:57.130Z", "datePublished": "2025-09-11T16:56:31.142Z", "dateUpdated": "2026-08-05T12:05:05.360Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T12:05:05.360Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nsched/ext: Fix invalid task state transitions on class switch\n\nWhen enabling a sched_ext scheduler, we may trigger invalid task state\ntransitions, resulting in warnings like the following (which can be\neasily reproduced by running the hotplug selftest in a loop):\n\n sched_ext: Invalid task state transition 0 -> 3 for fish[770]\n WARNING: CPU: 18 PID: 787 at kernel/sched/ext.c:3862 scx_set_task_state+0x7c/0xc0\n ...\n RIP: 0010:scx_set_task_state+0x7c/0xc0\n ...\n Call Trace:\n <TASK>\n scx_enable_task+0x11f/0x2e0\n switching_to_scx+0x24/0x110\n scx_enable.isra.0+0xd14/0x13d0\n bpf_struct_ops_link_create+0x136/0x1a0\n __sys_bpf+0x1edd/0x2c30\n __x64_sys_bpf+0x21/0x30\n do_syscall_64+0xbb/0x370\n entry_SYSCALL_64_after_hwframe+0x77/0x7f\n\nThis happens because we skip initialization for tasks that are already\ndead (with their usage counter set to zero), but we don't exclude them\nduring the scheduling class transition phase.\n\nFix this by also skipping dead tasks during class swiching, preventing\ninvalid task state transitions."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:L - The vulnerable path is entered through the local `bpf(BPF_LINK_CREATE)` syscall attaching a sched_ext struct_ops scheduler, combined with local task fork/exit churn to populate the race window. No network-reachable code is involved.\nAC:L - The attacker controls both sides of the race \u2014 generating a storm of exiting tasks (each of which sits on `scx_tasks` with `usage == 0` for a full RCU grace period, since `put_task_struct()` always defers via `call_rcu()`) while repeatedly enabling a scheduler; upstream states it is \"easily reproduced by running the hotplug selftest in a loop\".\nPR:L - Enabling a sched_ext scheduler needs only `bpf_token_capable(CAP_BPF)`, which is delegable to unprivileged users in user namespaces via BPF tokens (and is open on `unprivileged_bpf_disabled=0` systems); on deployments where a daemon such as scx_loader switches schedulers, a wholly unprivileged user supplies the dying-task half of the race.\nUI:N - The entire sequence \u2014 scheduler attach plus fork/exit churn \u2014 is driven by the attacker's own processes. No victim action is required.\nS:U - The corruption is confined to kernel scheduler state within the same security authority; no VM, IOMMU, or sandbox boundary is crossed.\nC:H - The code reads and writes a `task_struct` whose usage refcount has already reached zero and which is queued for RCU-deferred destruction \u2014 the exact condition the `Fixes:` commit identifies as a use-after-free hazard \u2014 and drives BPF `ops.enable()`/`ops.exit_task()` against a task with no allocated per-task context, exposing stale/foreign scheduler state.\nI:H - `p->sched_class` (a pointer to the scheduling-class function-pointer dispatch table), `p->scx.slice`, and `p->scx.flags` are written into an object that is mid-teardown and pending free, and the sched_ext task state machine is forced through an illegal `NONE -> ENABLED` transition that corrupts BPF-scheduler per-task accounting.\nA:H - The bug triggers a `WARN_ONCE()` splat in `scx_set_task_state()`, which is an immediate kernel panic on the many hardened, cloud, Android, and CI configurations that set `panic_on_warn`; additionally the resulting contract violation makes real BPF schedulers call `scx_bpf_error()`, ejecting the scheduler and disrupting scheduling system-wide."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["kernel/sched/ext.c"], "versions": [{"version": "a8532fac7b5d27b8d62008a89593dccb6f9786ef", "lessThan": "786f6314604b34c3e7de5f733f4e08e35c448a50", "status": "affected", "versionType": "git"}, {"version": "a8532fac7b5d27b8d62008a89593dccb6f9786ef", "lessThan": "6a32cbe95029ebe21cc08349fd7ef2a3d32d2043", "status": "affected", "versionType": "git"}, {"version": "a8532fac7b5d27b8d62008a89593dccb6f9786ef", "lessThan": "ddf7233fcab6c247379d0928d46cc316ee122229", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["kernel/sched/ext.c"], "versions": [{"version": "6.12", "status": "affected"}, {"version": "0", "lessThan": "6.12", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.44", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.16.4", "lessThanOrEqual": "6.16.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.17", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.12", "versionEndExcluding": "6.12.44"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.12", "versionEndExcluding": "6.16.4"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.12", "versionEndExcluding": "6.17"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/786f6314604b34c3e7de5f733f4e08e35c448a50"}, {"url": "https://git.kernel.org/stable/c/6a32cbe95029ebe21cc08349fd7ef2a3d32d2043"}, {"url": "https://git.kernel.org/stable/c/ddf7233fcab6c247379d0928d46cc316ee122229"}], "title": "sched/ext: Fix invalid task state transitions on class switch", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["kernel/sched/ext.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "786f6314604b34c3e7de5f733f4e08e35c448a50", "status": "affected", "version": "a8532fac7b5d27b8d62008a89593dccb6f9786ef", "versionType": "git"}, {"lessThan": "6a32cbe95029ebe21cc08349fd7ef2a3d32d2043", "status": "affected", "version": "a8532fac7b5d27b8d62008a89593dccb6f9786ef", "versionType": "git"}, {"lessThan": "ddf7233fcab6c247379d0928d46cc316ee122229", "status": "affected", "version": "a8532fac7b5d27b8d62008a89593dccb6f9786ef", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["kernel/sched/ext.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "6.12"}, {"lessThan": "6.12", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.44", "versionType": "semver"}, {"lessThanOrEqual": "6.16.*", "status": "unaffected", "version": "6.16.4", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "6.17", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "14C4B269-8787-47B5-A04C-8BFCE8F9C2D8", "versionEndExcluding": "6.12.44", "versionStartIncluding": "6.12", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "AFC28995-B8C3-4B68-8CB6-78E792B6629D", "versionEndExcluding": "6.16.4", "versionStartIncluding": "6.13", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.17:rc1:*:*:*:*:*:*", "matchCriteriaId": "327D22EF-390B-454C-BD31-2ED23C998A1C", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.17:rc2:*:*:*:*:*:*", "matchCriteriaId": "C730CD9A-D969-4A8E-9522-162AAF7C0EE9", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nsched/ext: Fix invalid task state transitions on class switch\n\nWhen enabling a sched_ext scheduler, we may trigger invalid task state\ntransitions, resulting in warnings like the following (which can be\neasily reproduced by running the hotplug selftest in a loop):\n\n sched_ext: Invalid task state transition 0 -> 3 for fish[770]\n WARNING: CPU: 18 PID: 787 at kernel/sched/ext.c:3862 scx_set_task_state+0x7c/0xc0\n ...\n RIP: 0010:scx_set_task_state+0x7c/0xc0\n ...\n Call Trace:\n <TASK>\n scx_enable_task+0x11f/0x2e0\n switching_to_scx+0x24/0x110\n scx_enable.isra.0+0xd14/0x13d0\n bpf_struct_ops_link_create+0x136/0x1a0\n __sys_bpf+0x1edd/0x2c30\n __x64_sys_bpf+0x21/0x30\n do_syscall_64+0xbb/0x370\n entry_SYSCALL_64_after_hwframe+0x77/0x7f\n\nThis happens because we skip initialization for tasks that are already\ndead (with their usage counter set to zero), but we don't exclude them\nduring the scheduling class transition phase.\n\nFix this by also skipping dead tasks during class swiching, preventing\ninvalid task state transitions."}, {"lang": "es", "value": "En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nsched/ext: Corrige transiciones de estado de tarea inv\u00e1lidas en el cambio de clase\n\nAl habilitar un planificador sched_ext, podemos desencadenar transiciones de estado de tarea inv\u00e1lidas, lo que resulta en advertencias como las siguientes (que se pueden reproducir f\u00e1cilmente ejecutando la autoprueba de hotplug en un bucle):\n\n sched_ext: Transici\u00f3n de estado de tarea inv\u00e1lida 0 -> 3 para fish[770]\n ADVERTENCIA: CPU: 18 PID: 787 en kernel/sched/ext.c:3862 scx_set_task_state+0x7c/0xc0\n ...\n RIP: 0010:scx_set_task_state+0x7c/0xc0\n ...\n Traza de Llamada:\n <TAREA>\n scx_enable_task+0x11f/0x2e0\n switching_to_scx+0x24/0x110\n scx_enable.isra.0+0xd14/0x13d0\n bpf_struct_ops_link_create+0x136/0x1a0\n __sys_bpf+0x1edd/0x2c30\n __x64_sys_bpf+0x21/0x30\n do_syscall_64+0xbb/0x370\n entry_SYSCALL_64_after_hwframe+0x77/0x7f\n\nEsto sucede porque omitimos la inicializaci\u00f3n para tareas que ya est\u00e1n muertas (con su contador de uso establecido en cero), pero no las excluimos durante la fase de transici\u00f3n de clase de planificaci\u00f3n.\n\nSoluciona esto tambi\u00e9n omitiendo tareas muertas durante el cambio de clase, evitando transiciones de estado de tarea inv\u00e1lidas."}], "id": "CVE-2025-39780", "lastModified": "2026-10-19T21:10:00.160", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2025-09-11T17:15:43.900", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/6a32cbe95029ebe21cc08349fd7ef2a3d32d2043"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/786f6314604b34c3e7de5f733f4e08e35c448a50"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/ddf7233fcab6c247379d0928d46cc316ee122229"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "NVD-CWE-noinfo"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{"bugzilla": {"description": "kernel: sched/ext: Fix invalid task state transitions on class switch", "id": "2394609", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2394609"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "details": ["No description is available for this CVE."], "name": "CVE-2025-39780", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2025-09-11T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2025-39780\nhttps://nvd.nist.gov/vuln/detail/CVE-2025-39780\nhttps://lore.kernel.org/linux-cve-announce/2025091149-CVE-2025-39780-a1da@gregkh/T"], "threat_severity": "Moderate"}

{"created": "2025-09-12T08:02:37.576061+00:00", "updated": "2025-09-12T08:02:37.576114+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}