CVE-2026-53328: Linux Kernel Sched_ext False Warning on NULL cgrp_moving_from

Technical summary

CVE-2026-53328 affects the scx_cgroup_move_task() function in kernel/sched/ext.c. When a cgroup's subsystems are toggled (cpu disabled then re-enabled), the kernel creates a new css (control group subsystem instance) for that cgroup. If a task exits while still holding a reference to the old css, and then a later operation (such as enabling memory control) triggers a global cgroup migration, the scx_cgroup_move_task() function may encounter a NULL cgrp_moving_from value. This occurs because scx_cgroup_can_attach() only sets cgrp_moving_from when a task's cgroup identity changes, but css identity changes can occur independently. The NULL check at line 3227 unconditionally warns, even though a NULL value here is a valid css-only migration scenario. The fix removes the spurious WARN macro, as the call site is already guarded by a conditional that prevents NULL dereferences.

Business impact

This vulnerability presents minimal direct business risk; it does not enable privilege escalation, data theft, or system compromise. Its primary impact is operational: false-positive warnings in kernel logs can trigger monitoring systems, generate alert fatigue, and consume security team attention. Organizations running sched_ext schedulers (a relatively specialized use case) may experience log noise and misdiagnosis of system health. The fix is a one-line removal of a diagnostic warning, making remediation straightforward and low-risk.

Affected systems

The vulnerability affects the Linux kernel across multiple releases that include sched_ext support. sched_ext is a framework for custom CPU schedulers and is available in recent stable kernels and distributions that have opted to enable it. The issue is triggered specifically when (1) a sched_ext scheduler is loaded, (2) systemd's user manager modifies cgroup subsystem controls (a routine operation), and (3) the cpu cgroup subsystem is toggled on the affected cgroup. Most production Linux systems do not run sched_ext by default, limiting real-world exposure.

Exploitability

This is not exploitable in the traditional sense. It does not enable an attacker to gain unauthorized access, escalate privileges, corrupt data, or achieve code execution. The warning is triggered by legitimate kernel internal operations. An attacker with the ability to manipulate cgroups locally could generate the warning artificially, but this would only cause log noise, not system compromise. The vulnerability is best classified as a logic defect rather than a security vulnerability, though the CVSS 5.5 MEDIUM rating acknowledges the availability concern (filling logs, potential DoS if log space is constrained).

Remediation

Remove the WARN macro from scx_cgroup_move_task() when cgrp_moving_from is NULL. This requires a kernel rebuild and reboot. The fix is minimal and does not alter the function's correctness—it only removes an inappropriate diagnostic that fires on a valid code path. The function's call site already performs the necessary NULL check, so removing the warning is safe and aligns the code with the intended behavior.

Patch guidance

Verify against the vendor advisory or Linux kernel stable tree for the exact patch commit. The fix involves kernel/sched/ext.c, specifically removing or gating the WARN at or near line 3227. Affected kernel versions should be confirmed by checking the Linux kernel security advisories or the stable release notes. Most users should wait for their distribution's packaged kernel update rather than building from source. If your organization runs a custom sched_ext scheduler, coordinate patching with any downstream dependencies.

Detection guidance

Monitor kernel logs for repeated warnings matching the pattern "WARNING: at kernel/sched/ext.c:3227 scx_cgroup_move_task". If you see this warning but no actual task migration failures or system instability, the warning itself is the defect—not evidence of a separate underlying problem. Once patched, the warning should disappear from logs. Confirming absence of the warning after patching is the best indicator of successful remediation. Organizations not using sched_ext can safely ignore this issue.

Why prioritize this

Although rated MEDIUM (5.5 CVSS), this should be a low-priority patch for most organizations because (1) sched_ext is not enabled in typical production kernels, (2) the vulnerability does not enable exploitation or data loss, and (3) the only impact is false-positive log warnings. Prioritize this only if you explicitly use sched_ext schedulers and the log noise is creating alert fatigue or consuming significant disk space. For general infrastructure, defer this patch until the next routine kernel maintenance window.

Risk score, explained

The CVSS 5.5 MEDIUM score reflects an availability concern (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H). A local user with standard privileges can trigger the warning repeatedly, potentially filling log buffers and degrading system observability. However, the impact is confined to log pollution and does not affect data confidentiality or integrity. The scoring appropriately penalizes the flaw for operational nuisance but correctly excludes it from high-risk categories reserved for direct system compromise.

Frequently asked questions