{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-31733", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-03-09T15:48:24.137Z", "datePublished": "2026-05-01T14:14:31.558Z", "dateUpdated": "2026-05-11T22:14:42.580Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-05-11T22:14:42.580Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nsched_ext: Fix stale direct dispatch state in ddsp_dsq_id\n\n@p->scx.ddsp_dsq_id can be left set (non-SCX_DSQ_INVALID) triggering a\nspurious warning in mark_direct_dispatch() when the next wakeup's\nops.select_cpu() calls scx_bpf_dsq_insert(), such as:\n\n WARNING: kernel/sched/ext.c:1273 at scx_dsq_insert_commit+0xcd/0x140\n\nThe root cause is that ddsp_dsq_id was only cleared in dispatch_enqueue(),\nwhich is not reached in all paths that consume or cancel a direct dispatch\nverdict.\n\nFix it by clearing it at the right places:\n\n - direct_dispatch(): cache the direct dispatch state in local variables\n and clear it before dispatch_enqueue() on the synchronous path. For\n the deferred path, the direct dispatch state must remain set until\n process_ddsp_deferred_locals() consumes them.\n\n - process_ddsp_deferred_locals(): cache the dispatch state in local\n variables and clear it before calling dispatch_to_local_dsq(), which\n may migrate the task to another rq.\n\n - do_enqueue_task(): clear the dispatch state on the enqueue path\n (local/global/bypass fallbacks), where the direct dispatch verdict is\n ignored.\n\n - dequeue_task_scx(): clear the dispatch state after dispatch_dequeue()\n to handle both the deferred dispatch cancellation and the holding_cpu\n race, covering all cases where a pending direct dispatch is\n cancelled.\n\n - scx_disable_task(): clear the direct dispatch state when\n transitioning a task out of the current scheduler. Waking tasks may\n have had the direct dispatch state set by the outgoing scheduler's\n ops.select_cpu() and then been queued on a wake_list via\n ttwu_queue_wakelist(), when SCX_OPS_ALLOW_QUEUED_WAKEUP is set. Such\n tasks are not on the runqueue and are not iterated by scx_bypass(),\n so their direct dispatch state won't be cleared. Without this clear,\n any subsequent SCX scheduler that tries to direct dispatch the task\n will trigger the WARN_ON_ONCE() in mark_direct_dispatch()."}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["kernel/sched/ext.c"], "versions": [{"version": "5b26f7b920f76b2b9cc398c252a9e35e44bf5bb9", "lessThan": "ca685511f7afd42cdcbb0feea42e5d332d384251", "status": "affected", "versionType": "git"}, {"version": "5b26f7b920f76b2b9cc398c252a9e35e44bf5bb9", "lessThan": "5e7b2cc8fae9ec2a5bc53311191d2faaff75a4b5", "status": "affected", "versionType": "git"}, {"version": "5b26f7b920f76b2b9cc398c252a9e35e44bf5bb9", "lessThan": "7ea601daa0153e19cd1c6e6b300348c70c05fe77", "status": "affected", "versionType": "git"}, {"version": "5b26f7b920f76b2b9cc398c252a9e35e44bf5bb9", "lessThan": "7e0ffb72de8aa3b25989c2d980e81b829c577010", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["kernel/sched/ext.c"], "versions": [{"version": "6.12", "status": "affected"}, {"version": "0", "lessThan": "6.12", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.82", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.22", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.19.12", "lessThanOrEqual": "6.19.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.0", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.12", "versionEndExcluding": "6.12.82"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.12", "versionEndExcluding": "6.18.22"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.12", "versionEndExcluding": "6.19.12"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.12", "versionEndExcluding": "7.0"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/ca685511f7afd42cdcbb0feea42e5d332d384251"}, {"url": "https://git.kernel.org/stable/c/5e7b2cc8fae9ec2a5bc53311191d2faaff75a4b5"}, {"url": "https://git.kernel.org/stable/c/7ea601daa0153e19cd1c6e6b300348c70c05fe77"}, {"url": "https://git.kernel.org/stable/c/7e0ffb72de8aa3b25989c2d980e81b829c577010"}], "title": "sched_ext: Fix stale direct dispatch state in ddsp_dsq_id", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "12ED4499-597C-42BD-BD53-014753EC3EB0", "versionEndExcluding": "6.12.82", "versionStartIncluding": "6.12", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "C9DF8BCE-36D3-475D-9D21-19E4F02F9029", "versionEndExcluding": "6.18.22", "versionStartIncluding": "6.13", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "0A2B9540-02D5-41B4-B16A-82AF66FD4F36", "versionEndExcluding": "6.19.12", "versionStartIncluding": "6.19", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*", "matchCriteriaId": "F253B622-8837-4245-BCE5-A7BF8FC76A16", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*", "matchCriteriaId": "4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*", "matchCriteriaId": "F666C8D8-6538-46D4-B318-87610DE64C34", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*", "matchCriteriaId": "02259FDA-961B-47BC-AE7F-93D7EC6E90C2", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*", "matchCriteriaId": "58A9FEFF-C040-420D-8F0A-BFDAAA1DF258", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*", "matchCriteriaId": "1D2315C0-D46F-4F85-9754-F9E5E11374A6", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nsched_ext: Fix stale direct dispatch state in ddsp_dsq_id\n\n@p->scx.ddsp_dsq_id can be left set (non-SCX_DSQ_INVALID) triggering a\nspurious warning in mark_direct_dispatch() when the next wakeup's\nops.select_cpu() calls scx_bpf_dsq_insert(), such as:\n\n WARNING: kernel/sched/ext.c:1273 at scx_dsq_insert_commit+0xcd/0x140\n\nThe root cause is that ddsp_dsq_id was only cleared in dispatch_enqueue(),\nwhich is not reached in all paths that consume or cancel a direct dispatch\nverdict.\n\nFix it by clearing it at the right places:\n\n - direct_dispatch(): cache the direct dispatch state in local variables\n and clear it before dispatch_enqueue() on the synchronous path. For\n the deferred path, the direct dispatch state must remain set until\n process_ddsp_deferred_locals() consumes them.\n\n - process_ddsp_deferred_locals(): cache the dispatch state in local\n variables and clear it before calling dispatch_to_local_dsq(), which\n may migrate the task to another rq.\n\n - do_enqueue_task(): clear the dispatch state on the enqueue path\n (local/global/bypass fallbacks), where the direct dispatch verdict is\n ignored.\n\n - dequeue_task_scx(): clear the dispatch state after dispatch_dequeue()\n to handle both the deferred dispatch cancellation and the holding_cpu\n race, covering all cases where a pending direct dispatch is\n cancelled.\n\n - scx_disable_task(): clear the direct dispatch state when\n transitioning a task out of the current scheduler. Waking tasks may\n have had the direct dispatch state set by the outgoing scheduler's\n ops.select_cpu() and then been queued on a wake_list via\n ttwu_queue_wakelist(), when SCX_OPS_ALLOW_QUEUED_WAKEUP is set. Such\n tasks are not on the runqueue and are not iterated by scx_bypass(),\n so their direct dispatch state won't be cleared. Without this clear,\n any subsequent SCX scheduler that tries to direct dispatch the task\n will trigger the WARN_ON_ONCE() in mark_direct_dispatch()."}], "id": "CVE-2026-31733", "lastModified": "2026-05-07T16:44:45.520", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2026-05-01T15:16:35.913", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/5e7b2cc8fae9ec2a5bc53311191d2faaff75a4b5"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/7e0ffb72de8aa3b25989c2d980e81b829c577010"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/7ea601daa0153e19cd1c6e6b300348c70c05fe77"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/ca685511f7afd42cdcbb0feea42e5d332d384251"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "NVD-CWE-noinfo"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{"bugzilla": {"description": "kernel: sched_ext: Fix stale direct dispatch state in ddsp_dsq_id", "id": "2464432", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2464432"}, "csaw": false, "cwe": "CWE-772", "details": ["A flaw was found in the Linux kernel's `sched_ext` component. The scheduler's direct dispatch state (`ddsp_dsq_id`) was not consistently cleared across all execution paths. This oversight could leave the system in an incorrect state, leading to spurious warnings and unexpected behavior during task dispatch. Such inconsistencies can contribute to overall system instability."], "name": "CVE-2026-31733", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2026-05-01T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-31733\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-31733\nhttps://lore.kernel.org/linux-cve-announce/2026050137-CVE-2026-31733-aaa2@gregkh/T"]}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[5b26f7b920f76b2b9cc398c252a9e35e44bf5bb9,ca685511f7afd42cdcbb0feea42e5d332d384251)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[5b26f7b920f76b2b9cc398c252a9e35e44bf5bb9,5e7b2cc8fae9ec2a5bc53311191d2faaff75a4b5)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[5b26f7b920f76b2b9cc398c252a9e35e44bf5bb9,7ea601daa0153e19cd1c6e6b300348c70c05fe77)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[5b26f7b920f76b2b9cc398c252a9e35e44bf5bb9,7e0ffb72de8aa3b25989c2d980e81b829c577010)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "6.12"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[0,6.12)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.12.82,6.13.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.22,6.19.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.19.12,6.20.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.0,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-05-01T15:45:15.879758+00:00", "updated": "2026-05-07T17:30:25.998101+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}