CVE-2026-93220

In the Linux kernel, the following vulnerability has been resolved:

sched_ext: Keep kick_sync waiting on the rq's own CPU

kick_sync_wait_bal_cb() assumes it runs on the rq's CPU from the

__schedule() tail: the snapshots it compares against live in that CPU's

percpu area and the busy-wait runs with the rq lock dropped and IRQs

enabled.

However, dispatch can now drop the rq lock while the callback sits queued,

and rq lock takers in that window (the sched class change paths, the scx

task iterator) flush pending balance callbacks on release, running the

callback on a foreign CPU. Such a run compares against unrelated snapshots

and can deadlock when the executing CPU is itself a wait target.

Bail on a foreign CPU and leave the wait state alone. The wait only observes

progress that the resched kicks already guarantee and the rq's next wait

picks up the stale cpus_to_sync bits.