CVE-2026-74593

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-74593", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-08-15T05:44:03.919Z", "datePublished": "2026-08-22T15:31:44.160Z", "dateUpdated": "2026-08-23T12:47:36.437Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-23T12:47:36.437Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nsched_ext: Take cgroup_lock() first in scx_cgroup_lock()\n\nscx_cgroup_lock() write-locks scx_cgroup_ops_rwsem and then takes\ncgroup_lock(), which can deadlock through kernfs:\n\n scx enable/disable cgroup rmdir cpu.weight write\n ------------------ ------------ ----------------\n cgroup_lock()\n percpu_down_write(rwsem)\n cgroup_lock()\n kernfs_get_active()\n percpu_down_read(rwsem)\n kernfs_drain()\n\nThe enable path waits for the rmdir to release cgroup_mutex. The rmdir,\ndeactivating the cpu controller's files, waits in kernfs_drain() for the\nwrite's active reference. The write, in scx_group_set_weight(), waits for\nthe rwsem behind the pending writer.\n\nTake cgroup_lock() first. The set_* paths take no cgroup locks inside the\nread side, so a pending write-lock then only waits for read sections that\nalways run to completion, and no dependency from the rwsem back to\ncgroup_mutex remains."}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["kernel/sched/ext/ext.c"], "versions": [{"version": "a5bd6ba30b3364354269b81ac55c2edca9a96d6d", "lessThan": "2ca6b43edf83f8fc368cc3094ee5f3b1e8e0b0f0", "status": "affected", "versionType": "git"}, {"version": "a5bd6ba30b3364354269b81ac55c2edca9a96d6d", "lessThan": "a054c9ffa9b7a0dffb763837b91ac9d381ec6d10", "status": "affected", "versionType": "git"}, {"version": "a5bd6ba30b3364354269b81ac55c2edca9a96d6d", "lessThan": "5f8b69642d18e1f3e11996707842ac530444e959", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["kernel/sched/ext/ext.c"], "versions": [{"version": "6.18", "status": "affected"}, {"version": "0", "lessThan": "6.18", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.46", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.1.9", "lessThanOrEqual": "7.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.18", "versionEndExcluding": "6.18.46"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.18", "versionEndExcluding": "7.1.9"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.18", "versionEndExcluding": "7.2"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/2ca6b43edf83f8fc368cc3094ee5f3b1e8e0b0f0"}, {"url": "https://git.kernel.org/stable/c/a054c9ffa9b7a0dffb763837b91ac9d381ec6d10"}, {"url": "https://git.kernel.org/stable/c/5f8b69642d18e1f3e11996707842ac530444e959"}], "title": "sched_ext: Take cgroup_lock() first in scx_cgroup_lock()", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["kernel/sched/ext/ext.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "2ca6b43edf83f8fc368cc3094ee5f3b1e8e0b0f0", "status": "affected", "version": "a5bd6ba30b3364354269b81ac55c2edca9a96d6d", "versionType": "git"}, {"lessThan": "a054c9ffa9b7a0dffb763837b91ac9d381ec6d10", "status": "affected", "version": "a5bd6ba30b3364354269b81ac55c2edca9a96d6d", "versionType": "git"}, {"lessThan": "5f8b69642d18e1f3e11996707842ac530444e959", "status": "affected", "version": "a5bd6ba30b3364354269b81ac55c2edca9a96d6d", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["kernel/sched/ext/ext.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "6.18"}, {"lessThan": "6.18", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.46", "versionType": "semver"}, {"lessThanOrEqual": "7.1.*", "status": "unaffected", "version": "7.1.9", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.2", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nsched_ext: Take cgroup_lock() first in scx_cgroup_lock()\n\nscx_cgroup_lock() write-locks scx_cgroup_ops_rwsem and then takes\ncgroup_lock(), which can deadlock through kernfs:\n\n scx enable/disable cgroup rmdir cpu.weight write\n ------------------ ------------ ----------------\n cgroup_lock()\n percpu_down_write(rwsem)\n cgroup_lock()\n kernfs_get_active()\n percpu_down_read(rwsem)\n kernfs_drain()\n\nThe enable path waits for the rmdir to release cgroup_mutex. The rmdir,\ndeactivating the cpu controller's files, waits in kernfs_drain() for the\nwrite's active reference. The write, in scx_group_set_weight(), waits for\nthe rwsem behind the pending writer.\n\nTake cgroup_lock() first. The set_* paths take no cgroup locks inside the\nread side, so a pending write-lock then only waits for read sections that\nalways run to completion, and no dependency from the rwsem back to\ncgroup_mutex remains."}, {"lang": "es", "value": "En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nsched_ext: Tomar cgroup_lock() primero en scx_cgroup_lock()\n\nscx_cgroup_lock() bloquea en modo escritura scx_cgroup_ops_rwsem y luego toma cgroup_lock(), lo que puede causar un interbloqueo a trav\u00e9s de kernfs:\n\n scx habilitar/deshabilitar cgroup rmdir cpu.weight escritura\n ------------------------- ------------ -------------------\n cgroup_lock()\n percpu_down_write(rwsem)\n cgroup_lock()\n kernfs_get_active()\n percpu_down_read(rwsem)\n kernfs_drain()\n\nLa ruta de habilitaci\u00f3n espera a que el rmdir libere cgroup_mutex. El rmdir, al desactivar los archivos del controlador de CPU, espera en kernfs_drain() la referencia activa de la escritura. La escritura, en scx_group_set_weight(), espera al rwsem detr\u00e1s del escritor pendiente.\n\nTomar cgroup_lock() primero. Las rutas set_* no toman bloqueos de cgroup dentro del lado de lectura, por lo que un bloqueo de escritura pendiente entonces solo espera por secciones de lectura que siempre se ejecutan hasta su finalizaci\u00f3n, y no queda ninguna dependencia del rwsem de vuelta a cgroup_mutex."}], "id": "CVE-2026-74593", "lastModified": "2026-10-14T13:10:00.187", "metrics": {}, "published": "2026-08-22T16:16:31.573", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/2ca6b43edf83f8fc368cc3094ee5f3b1e8e0b0f0"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/5f8b69642d18e1f3e11996707842ac530444e959"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/a054c9ffa9b7a0dffb763837b91ac9d381ec6d10"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{"bugzilla": {"description": "kernel: sched_ext: Take cgroup_lock() first in scx_cgroup_lock()", "id": "2521403", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2521403"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-833", "details": ["In the Linux kernel, the following vulnerability has been resolved:\nsched_ext: Take cgroup_lock() first in scx_cgroup_lock()\nscx_cgroup_lock() write-locks scx_cgroup_ops_rwsem and then takes\ncgroup_lock(), which can deadlock through kernfs:\nscx enable/disable cgroup rmdir cpu.weight write\n------------------ ------------ ----------------\ncgroup_lock()\npercpu_down_write(rwsem)\ncgroup_lock()\nkernfs_get_active()\npercpu_down_read(rwsem)\nkernfs_drain()\nThe enable path waits for the rmdir to release cgroup_mutex. The rmdir,\ndeactivating the cpu controller's files, waits in kernfs_drain() for the\nwrite's active reference. The write, in scx_group_set_weight(), waits for\nthe rwsem behind the pending writer.\nTake cgroup_lock() first. The set_* paths take no cgroup locks inside the\nread side, so a pending write-lock then only waits for read sections that\nalways run to completion, and no dependency from the rwsem back to\ncgroup_mutex remains.", "A flaw was found in the Linux kernel's `sched_ext` component. An incorrect locking order within the `scx_cgroup_lock()` function can lead to a deadlock. This occurs when certain cgroup operations, such as enabling/disabling `scx` or removing a cgroup, happen concurrently with `cpu.weight` writes. A local attacker could exploit this to cause a system-wide Denial of Service (DoS)."], "name": "CVE-2026-74593", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2026-08-22T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-74593\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-74593\nhttps://lore.kernel.org/linux-cve-announce/2026082213-CVE-2026-74593-f241@gregkh/T"], "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[a5bd6ba30b3364354269b81ac55c2edca9a96d6d,a054c9ffa9b7a0dffb763837b91ac9d381ec6d10)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[a5bd6ba30b3364354269b81ac55c2edca9a96d6d,5f8b69642d18e1f3e11996707842ac530444e959)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "6.18"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[0,6.18)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.1.9,7.2.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.2,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-08-22T17:00:10.307085+00:00", "updated": "2026-08-26T03:45:03.835976+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}