Linux Kernel up to 7.2.3 sched_ext kick_sync_wait_bal_cb deadlock

Summaryinfo

A vulnerability was found in Linux Kernel up to 7.2.3. It has been classified as critical. Affected by this issue is the function kick_sync_wait_bal_cb of the component sched_ext. The manipulation leads to deadlock. This vulnerability is documented as CVE-2026-93220. The attack can be initiated remotely. There is not any exploit available. Upgrading the affected component is recommended.

Detailsinfo

A vulnerability, which was classified as critical, has been found in Linux Kernel up to 7.2.3. This issue affects the function kick_sync_wait_bal_cb of the component sched_ext. The manipulation with an unknown input leads to a deadlock vulnerability. Using CWE to declare the problem leads to CWE-833. The product contains multiple threads or executable segments that are waiting for each other to release a necessary lock, resulting in deadlock. Impacted is availability. The summary by CVE is:

In the Linux kernel, the following vulnerability has been resolved: sched_ext: Keep kick_sync waiting on the rq's own CPU kick_sync_wait_bal_cb() assumes it runs on the rq's CPU from the __schedule() tail: the snapshots it compares against live in that CPU's percpu area and the busy-wait runs with the rq lock dropped and IRQs enabled. However, dispatch can now drop the rq lock while the callback sits queued, and rq lock takers in that window (the sched class change paths, the scx task iterator) flush pending balance callbacks on release, running the callback on a foreign CPU. Such a run compares against unrelated snapshots and can deadlock when the executing CPU is itself a wait target. Bail on a foreign CPU and leave the wait state alone. The wait only observes progress that the resched kicks already guarantee and the rq's next wait picks up the stale cpus_to_sync bits.

The advisory is shared at git.kernel.org. The identification of this vulnerability is CVE-2026-93220 since 09/17/2026. The exploitation is known to be easy. The attack may be initiated remotely. Technical details are known, but no exploit is available. The price for an exploit might be around USD $0-$5k at the moment (estimation calculated on 09/24/2026). MITRE ATT&CK project uses the attack technique T1499 for this issue.

Upgrading to version 7.2.4 or 7.3-rc1 eliminates this vulnerability. Applying the patch c736ea0fe7b4df920da6bd43a81c5eeecadcc8be/e0253dd04beb03e79477c5ef4768b11135687206 is able to eliminate this problem. The best possible mitigation is suggested to be upgrading to the latest version.

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Productinfo

Type

• Operating System

Vendor

• Linux

Name

• Kernel

Version

• 7.2.0
• 7.2.1
• 7.2.2
• 7.2.3

License

• open-source

Website

• Vendor: https://www.kernel.org/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Discussion