CVE-2025-21657 Details
Description
In the Linux kernel, the following vulnerability has been resolved: sched_ext: Replace rq_lock() to raw_spin_rq_lock() in scx_ops_bypass() scx_ops_bypass() iterates all CPUs to re-enqueue all the scx tasks. For each CPU, it acquires a lock using rq_lock() regardless of whether a CPU is offline or the CPU is currently running a task in a higher scheduler class (e.g., deadline). The rq_lock() is supposed to be used for online CPUs, and the use of rq_lock() may trigger an unnecessary warning in rq_pin_lock(). Therefore, replace rq_lock() to raw_spin_rq_lock() in scx_ops_bypass(). Without this change, we observe the following warning: ===== START ===== [ 6.615205] rq->balance_callback && rq->balance_callback != &balance_push_callback [ 6.615208] WARNING: CPU: 2 PID: 0 at kernel/sched/sched.h:1730 __schedule+0x1130/0x1c90 ===== END =====
A vulnerability in the Linux kernel's scheduler has been addressed by modifying the locking mechanism in the SCX operations bypass function. Previously, the function used rq_lock() to acquire locks while iterating through CPUs, which could lead to warnings if a CPU was offline or handling a task in a higher scheduler class, such as deadline. The rq_lock() is intended for online CPUs only. The change to raw_spin_rq_lock() prevents these unnecessary warnings and aligns the locking behavior with the CPU's state.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
No SSVC data is available for this CVE.
References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://git.kernel.org/stable/c/6268d5bc10354fc2ab8d44a0cd3b042d49a0417e | kernel.org | Patch |
| https://git.kernel.org/stable/c/d9e446dd63cee7161717a6a8414ba9c6435af764 | kernel.org | Patch |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| NVD-CWE-noinfo | Insufficient Information to Classify Weakness | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| linux linux kernel | >= 6.12.1, < 6.12.10 6.12 - 6.12 rc6 6.12 rc7 6.13 rc1 6.13 rc2 6.13 rc3 6.13 rc4 6.13 rc5 6.13 rc6 |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | kernel.org |
| Oct 15, 2025 | Initial Analysis | [email protected] |
| Jan 21, 2025 | New CVE Received | kernel.org |