Skip to content
OpenAdvisories
Unscored CVE-2026-53328 EUVD-2026-40962GHSA-q89p-4x7p-f9v9

sched_ext: Don't warn on NULL cgrp_moving_from in scx_cgroup_move_task()

Published Jul 1, 2026 · Assigned by Linux

Vendor: Linux Product: Linux Package: linux Package: linux Package: linux-allwinner-5.19 Package: linux-aws Package: linux-aws-5.0 Package: linux-aws-5.11 Package: linux-aws-5.13 Package: linux-aws-5.19 Package: linux-aws-5.3 Package: linux-aws-5.8 Package: linux-aws-6.14 Package: linux-aws-6.17 Package: linux-aws-6.2 Package: linux-aws-6.5 Package: linux-aws-7.0 Package: linux-azure Package: linux-azure-5.11 Package: linux-azure-5.13 Package: linux-azure-5.19 Package: linux-azure-5.3 Package: linux-azure-5.8 Package: linux-azure-6.11 Package: linux-azure-6.14 Package: linux-azure-6.17 Package: linux-azure-6.2 Package: linux-azure-6.5 Package: linux-azure-7.0 Package: linux-azure-edge Package: linux-azure-fde Package: linux-azure-fde-5.19 Package: linux-azure-fde-6.14 Package: linux-azure-fde-6.2 Package: linux-azure-fde-7.0 Package: linux-azure-nvidia-6.14 Package: linux-gcp Package: linux-gcp-5.11 Package: linux-gcp-5.13 Package: linux-gcp-5.19 Package: linux-gcp-5.3 Package: linux-gcp-5.8 Package: linux-gcp-6.11 Package: linux-gcp-6.14 Package: linux-gcp-6.17 Package: linux-gcp-6.2 Package: linux-gcp-6.5 Package: linux-gcp-7.0 Package: linux-gke Package: linux-gke-4.15 Package: linux-gke-5.15 Package: linux-gke-5.4 Package: linux-gkeop Package: linux-gkeop-5.15 Package: linux-gkeop-5.4 Package: linux-hwe Package: linux-hwe-5.11 Package: linux-hwe-5.13 Package: linux-hwe-5.19 Package: linux-hwe-5.8 Package: linux-hwe-6.11 Package: linux-hwe-6.14 Package: linux-hwe-6.17 Package: linux-hwe-6.2 Package: linux-hwe-6.5 Package: linux-hwe-7.0 Package: linux-hwe-edge Package: linux-ibm Package: linux-intel-5.13 Package: linux-intel-iot-realtime Package: linux-lowlatency-hwe-5.19 Package: linux-lowlatency-hwe-6.11 Package: linux-lowlatency-hwe-6.2 Package: linux-lowlatency-hwe-6.5 Package: linux-nvidia Package: linux-nvidia-6.11 Package: linux-nvidia-6.17 Package: linux-nvidia-6.2 Package: linux-nvidia-6.5 Package: linux-nvidia-7.0 Package: linux-nvidia-bos Package: linux-oem Package: linux-oem-5.10 Package: linux-oem-5.13 Package: linux-oem-5.14 Package: linux-oem-5.17 Package: linux-oem-5.6 Package: linux-oem-6.0 Package: linux-oem-6.1 Package: linux-oem-6.11 Package: linux-oem-6.14 Package: linux-oem-6.17 Package: linux-oem-6.5 Package: linux-oem-6.8 Package: linux-oem-7.0 Package: linux-oracle Package: linux-oracle-5.0 Package: linux-oracle-5.11 Package: linux-oracle-5.13 Package: linux-oracle-5.3 Package: linux-oracle-5.8 Package: linux-oracle-6.14 Package: linux-oracle-6.17 Package: linux-oracle-6.5 Package: linux-oracle-7.0 Package: linux-raspi Package: linux-raspi-realtime Package: linux-raspi2 Package: linux-realtime Package: linux-realtime-6.14 Package: linux-realtime-6.17 Package: linux-riscv Package: linux-riscv-5.11 Package: linux-riscv-5.19 Package: linux-riscv-5.8 Package: linux-riscv-6.14 Package: linux-riscv-6.17 Package: linux-riscv-6.5 Package: linux-riscv-7.0 Package: linux-starfive-5.19 Package: linux-starfive-6.2 Package: linux-starfive-6.5 Package: linux-vmware Platform: Linux Ecosystem: Debian Ecosystem: Ubuntu

Description

In the Linux kernel, the following vulnerability has been resolved:

sched_ext: Don't warn on NULL cgrp_moving_from in scx_cgroup_move_task()

A WARN fires when systemd's user manager writes "+cpu +memory +pids" to
its own subtree_control while a sched_ext scheduler is loaded:

WARNING: at kernel/sched/ext.c:3227 scx_cgroup_move_task+0xa8/0xb0
scx_cgroup_move_task+0xa8/0xb0
sched_move_task+0x134/0x290
cpu_cgroup_attach+0x39/0x70
cgroup_migrate_execute+0x37d/0x450
cgroup_update_dfl_csses+0x1e3/0x270
cgroup_subtree_control_write+0x3e7/0x440

scx_cgroup_can_attach() arms cgrp_moving_from only when a task's cpu
cgroup changes. It can still be NULL when scx_cgroup_move_task() runs,
through this sequence:

Step Result
--------------------------------- ----------------------------------
1. cpu enabled on cgroup G cpu css = A
2. cpu toggled off then on for G A killed, B created (same cgroup)
3. an exiting task keeps A alive migration skips it, A now stale
4. +memory migrates G stale A vs current B pulls cpu in
5. cpu attach runs for all tasks hits a live, cpu-unchanged task
6. scx_cgroup_move_task() on it cgrp_moving_from NULL -> WARN

The mismatch is that scx_cgroup_can_attach() keys on cgroup identity
while migration drives the move on css identity, so a NULL cgrp_moving_from
here is a legitimate css-only migration, not a missing prep.

The call is already gated on cgrp_moving_from, so just drop the warning.
ops.cgroup_prep_move() and ops.cgroup_move() stay paired.

Affected products

VendorProductAffectedFixed
Linux Linux 6.12 6.12.94

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

ReleasePackageFixed inAdvisory
Debian 14 linux 7.0.13-1 —
Debian 13 linux 6.12.94-1 —
ReleasePackageFixed inAdvisory
Ubuntu 26.04 LTS linux 7.0.0-31.31 USN-8726-1
Ubuntu 26.04 LTS linux-aws 7.0.0-1012.12 USN-8726-1
Ubuntu 26.04 LTS linux-azure 7.0.0-1014.14 USN-8726-4
Ubuntu 26.04 LTS linux-gcp +1 7.0.0-1011.11 USN-8726-4, USN-8726-1
Ubuntu 26.04 LTS linux-gke 7.0.0-1006.7 USN-8726-1
Ubuntu 26.04 LTS linux-ibm +2 7.0.0-1013.13 USN-8727-1, USN-8726-3
Ubuntu 26.04 LTS linux-nvidia 7.0.0-1018.18 USN-8760-2
Ubuntu 26.04 LTS linux-nvidia-bos 7.0.0-2018.18 USN-8800-1
Ubuntu 26.04 LTS linux-raspi 7.0.0-1019.19 USN-8726-2
Ubuntu 26.04 LTS linux-riscv +1 7.0.0-31.31.1 USN-8726-1
Ubuntu 25.10 linux +8 No fix yet —
Ubuntu 24.04 LTS linux-aws-7.0 7.0.0-1012.12~24.04.1 USN-8726-1
Ubuntu 24.04 LTS linux-azure-7.0 7.0.0-1014.14~24.04.1 USN-8728-2
Ubuntu 24.04 LTS linux-azure-fde-7.0 7.0.0-1013.13~24.04.1 —
Ubuntu 24.04 LTS linux-gcp-7.0 +1 7.0.0-1011.11~24.04.1 USN-8728-3, USN-8728-1
Ubuntu 24.04 LTS linux-hwe-7.0 7.0.0-31.31~24.04.1 USN-8726-1
Ubuntu 24.04 LTS linux-nvidia-7.0 7.0.0-1018.18~24.04.1 USN-8760-1
Ubuntu 24.04 LTS linux-riscv +26 No fix yet —
Ubuntu 24.04 LTS linux-riscv-7.0 7.0.0-31.31.1~24.04.1 —
Ubuntu 22.04 LTS linux-riscv +32 No fix yet —
Ubuntu 20.04 LTS linux-gke +28 No fix yet —
Show 3 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
Ubuntu 18.04 LTS linux-gcp +14 No fix yet —
Ubuntu 16.04 LTS linux-hwe-edge No fix yet —
Ubuntu Pro Realtime 24.04 LTS linux-realtime-6.14 +1 No fix yet —

Amazon Linux

ReleasePackageFixed inAdvisory
Amazon Linux 2023 kernel-livepatch-6.18.36-69.134 +1 1:1.0-0.amzn2023 ALAS2023-2026-1968, ALAS2023-2026-1925
Amazon Linux 2023 perf6.12 +11 1:6.12.94-123.174.amzn2023 ALAS2023-2026-1968
Amazon Linux 2023 perf6.18 +12 1:6.18.36-69.134.amzn2023 ALAS2023-2026-1925

Oracle Linux

ReleasePackageFixed inAdvisory
Oracle Linux 9 kernel-uek +34 6.12.0-206.104.3.3.el10uek ELSA-2026-500248

Advisories 15

References