CVE-2025-39780
BaseFortify
Publication date: 2025-09-11
Last updated on: 2025-11-25
Assigner: kernel.org
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| linux | linux_kernel | From 5.15.160 (inc) to 5.16 (inc) |
| linux | linux_kernel | 6.17 |
| linux | linux_kernel | 6.17 |
| linux | linux_kernel | From 5.15.160 (inc) to 5.16 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-NVD-CWE-noinfo |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability in the Linux kernel's sched_ext scheduler causes invalid task state transitions during scheduling class switches. Specifically, tasks that are already dead (with usage counters at zero) are not properly excluded during the class switching phase, leading to warnings and potential instability. The issue arises because initialization is skipped for dead tasks, but they are not excluded during the transition, causing invalid state changes. The fix involves skipping dead tasks during class switching to prevent these invalid transitions.
How can this vulnerability impact me? :
This vulnerability can cause invalid task state transitions in the Linux kernel scheduler, which may lead to kernel warnings and potentially unstable or unpredictable system behavior when using the sched_ext scheduler. This could affect system reliability and performance, especially under workloads that trigger these transitions frequently.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by monitoring kernel warning messages related to invalid task state transitions when using the sched_ext scheduler. Specifically, look for warnings like: 'sched_ext: Invalid task state transition 0 -> 3 for fish[PID]' in the kernel logs. You can check for these messages using the command: dmesg | grep 'sched_ext: Invalid task state transition'. Running the hotplug selftest in a loop may reproduce the issue and help detect it.
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation involves avoiding enabling the sched_ext scheduler until the fix is applied, as the vulnerability occurs during sched_ext scheduler usage. Applying the kernel patch that fixes the invalid task state transitions by skipping dead tasks during class switching is necessary to fully resolve the issue.