Linux Kernel EUVD-2026-115794

Requires the Linux kernel to be built with sched_ext (CONFIG_SCHED_CLASS_EXT) AND a BPF struct_ops scheduler actually loaded and active - loading such a scheduler normally requires CAP_SYS_ADMIN, and when no sched_ext scheduler is attached the affected functions (scx_move_local_task_to_local_dsq, unlink_dsq_and_switch_rq_lock, move_task_between_dsqs) are not exercised, so the flaw is unreachable. Exploitation further requires a local presence on the host and winning the concurrency window between the dispatcher running ops.dequeue() and clearing SCX_OPSS_DISPATCHING; this is a timing-dependent race, so success is not guaranteed on a single attempt. Net limiting factors: local-only access, non-default sched_ext deployment, and a narrow race window - these materially reduce realistic exploitability below the raw 7.8 score for typical servers that do not run custom schedulers.

Available signals point to a genuine but situational local-privilege issue rather than a mass-exploitation emergency. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 7.8 HIGH) describes a local, low-privilege flaw with full confidentiality, integrity and availability impact - consistent with a kernel memory-safety race in the sched_ext scheduler that can corrupt task state. No EPSS probability was supplied, the CVE is not listed in CISA KEV, and no SSVC decision tree (automatable / technical impact) was provided; the only prioritization signal present is the vuln.today 'this_week' label, which indicates near-term patching but explicitly not act_now/emergency. No public exploit is identified - the only references are the two kernel.org stable fix commits, not proof-of-concept code. The practical ceiling on risk is the attack surface: the vulnerable code paths (scx_move_local_task_to_local_dsq(), unlink_dsq_and_switch_rq_lock(), move_task_between_dsqs()) are only reachable when a sched_ext BPF scheduler is loaded and active, which is uncommon in default production deployments. Conflicting metadata to verify: the 'Information Disclosure' tag understates the vendor-assigned I:H/A:H impact, which indicates corruption/availability effects, not confidentiality alone - treat the tag as incomplete rather than authoritative. Overall this is a legitimate local-escalation/DoS hardening fix to schedule for patching this week, not a widely-weaponized remote threat.

On a Linux system running an active sched_ext (SCX) BPF scheduler, a local user induces scheduling activity that causes a task to be consumed or moved off a non-local DSQ while the dispatching CPU is still executing ops.dequeue() and has not cleared SCX_OPSS_DISPATCHING. Winning that timing window lets the consume/move path operate on the task concurrently with the dispatcher, corrupting task scheduler state and potentially yielding local privilege escalation or a kernel crash. No public exploit code is identified; the only published artifacts are the stable-tree fix commits.