CVE-2026-89521: sched/core: Handle pick_task() releasing the rq lock

CVE-2026-89521: sched/core: Handle pick_task() releasing the rq lock

[Greg Kroah-Hartman]

From: Greg Kroah-Hartman <gregkh@kernel.org>

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

sched/core: Handle pick_task() releasing the rq lock

Core scheduling's pick_next_task() breaks when a ->pick_task()
implementation can release the rq lock. The selection state derived on entry
is only valid while the lock is held continuously. Once a pick can drop the
lock, an interleaving selection can invalidate all of it: the single-CPU
fast path can commit an uncookied pick although the core went cookied during
the release, and forceidle committed by the interleaving selection skews the
restarted pass's accounting.

Fix it by restarting the whole selection when a pick returns RETRY_TASK
after releasing the lock: a single restart point above the state derivation
replaces the per-loop restart labels, so a retry picks up state committed by
interleaving selections and accounts and resets forceidle like a fresh
selection would.

need_sync and fi_before latch across retries. Clock validity can't be
re-derived - there is no program-ordered way to tell whether the own and
core rq clocks are still updated after the lock was released, as other
lockers' pin cycles may or may not have invalidated them. When restarting,
clear core_clock_updated so that the sibling loop re-updates the core rq,
and update the own rq clock if invalidated.

The Linux kernel CVE team has assigned CVE-2026-89521 to this issue.


Affected and fixed versions
===========================

	Issue introduced in 6.19 with commit 4c95380701f58b8112f0b891de8d160e4199e19d and fixed in 7.2.4 with commit 88ed5a66467ca2a5148b9997af9c71d8c43060ad
	Issue introduced in 6.19 with commit 4c95380701f58b8112f0b891de8d160e4199e19d and fixed in 7.3-rc1 with commit c10b216a072ff5c57bc880a05f87eb519aecc529

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2026-89521
will be updated if fixes are backported, please check that for the most
up to date information about this issue.


Affected files
==============

The file(s) affected by this issue are:
	kernel/sched/core.c


Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/88ed5a66467ca2a5148b9997af9c71d8c43060ad
	https://git.kernel.org/stable/c/c10b216a072ff5c57bc880a05f87eb519aecc529