CVE-2025-39780

CVE-2025-39780

High · published September 11, 2025

CVSS v3.1
7.8
EPSS
0%
Percentile
4.2
In the wild
Unconfirmed
What it is

In the Linux kernel, the following vulnerability has been resolved:

sched/ext: Fix invalid task state transitions on class switch

When enabling a sched_ext scheduler, we may trigger invalid task state

transitions, resulting in warnings like the following (which can be

easily reproduced by running the hotplug selftest in a loop):

sched_ext: Invalid task state transition 0 -> 3 for fish[770]

WARNING: CPU: 18 PID: 787 at kernel/sched/ext.c:3862 scx_set_task_state+0x7c/0xc0

...

RIP: 0010:scx_set_task_state+0x7c/0xc0

...

Call Trace:

<TASK>

scx_enable_task+0x11f/0x2e0

switching_to_scx+0x24/0x110

scx_enable.isra.0+0xd14/0x13d0

bpf_struct_ops_link_create+0x136/0x1a0

__sys_bpf+0x1edd/0x2c30

__x64_sys_bpf+0x21/0x30

do_syscall_64+0xbb/0x370

entry_SYSCALL_64_after_hwframe+0x77/0x7f

This happens because we skip initialization for tasks that are already

dead (with their usage counter set to zero), but we don't exclude them

during the scheduling class transition phase.

Fix this by also skipping dead tasks during class swiching, preventing

invalid task state transitions.

The record
Technical detail
CVSS v3.1
7.8 · HIGH
Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00154 · 4.2th percentile
Published
2025-09-11T21:15Z
Affected products (4)
ProductVersionsFixed in
linux/linux_kernel≥ 6.12, < 6.12.446.12.44
linux/linux_kernel≥ 6.13, < 6.16.46.16.4
linux/linux_kernelall versions—
linux/linux_kernelall versions—
References (3)
EPSS history
Timeline
  • 11 SEP 16:56Z
    sched/ext: Fix invalid task state transitions on class switch
    cvelistv5