CVE-2026-31733: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-31733 is a stale direct dispatch state vulnerability in the Linux kernel's scheduler extension (sched_ext) subsystem, specifically in the ddsp_dsq_id field handling. The @p->scx.ddsp_dsq_id field can be left set to a non-SCX_DSQ_INVALID value, triggering spurious WARN_ON_ONCE() warnings in mark_direct_dispatch() during subsequent task wakeups. Affected Linux kernel versions include 6.12.x before 6.12.82, 6.13.x through 6.18.x before 6.18.22, 6.19.x before 6.19.12, and 7.0 release candidates. It was published on May 1, 2026, with patches added to stable branches by May 7, 2026. The CVSS v3.1 base score is 5.5 (Medium) (Red Hat Advisory, Red Hat Bugzilla).

The root cause is classified as CWE-772 (Missing Release of Resource after Effective Lifetime): the ddsp_dsq_id field was only cleared in dispatch_enqueue(), which is not reached in all code paths that consume or cancel a direct dispatch verdict. This leaves stale state that affects subsequent scheduler operations. Specifically, the bug manifests when ops.select_cpu() calls scx_bpf_dsq_insert() during a task wakeup, triggering a spurious WARNING at kernel/sched/ext.c:1273 in scx_dsq_insert_commit. The fix requires clearing the dispatch state in five locations: direct_dispatch(), process_ddsp_deferred_locals(), do_enqueue_task(), dequeue_task_scx(), and scx_disable_task() (Red Hat Bugzilla, Kernel Patch).

A local user with the ability to trigger task scheduling operations can cause kernel warnings and potentially denial-of-service conditions through spurious WARN_ON_ONCE() calls in the sched_ext scheduler, disrupting system stability. The vulnerability has no confidentiality or integrity impact — only availability is affected, and the scope is limited to the local system. There is no known path to privilege escalation or lateral movement from this vulnerability (Red Hat Advisory).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the time of publication. The EPSS score is approximately 0.018% (0.000180), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires local access and low privileges, limiting the attack surface (Red Hat Advisory).

• Logs: Kernel warning messages in system logs matching WARNING: kernel/sched/ext.c:1273 at scx_dsq_insert_commit+0xcd/0x140, indicating spurious WARN_ON_ONCE() triggers in the sched_ext scheduler (Red Hat Bugzilla).
• Process: Unusual or repeated task scheduling anomalies associated with BPF-based scheduler extensions (sched_ext) on systems using custom BPF schedulers.

Update the Linux kernel to a patched stable version: 6.12.82 or later, 6.18.22 or later, or 6.19.12 or later, as applicable to your branch. Patches are available in the upstream kernel stable tree (Kernel Patch, Kernel Patch, Kernel Patch). As a workaround, disabling the sched_ext scheduler if it is not required for your workload will prevent the vulnerable code paths from being triggered until patches can be applied (Red Hat Advisory).