CVE-2026-68421: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-68421 is a Linux kernel scheduler vulnerability in the sched_ext subsystem's put_prev_task_scx() function that can cause false warning triggers and potential denial of service when core scheduling (SMT sibling forced-idle) is active. The flaw was published on August 10, 2026, and affects Linux kernel versions starting from 6.12 up to (but not including) the patched commits. Fixed versions include kernel 6.18.42, 7.1.6, and 7.2-rc4. The CVSS category is estimated as Medium, with an EPSS score of 0.0 (GitHub Advisory, Feedly).

The root cause is an incorrect assumption in put_prev_task_scx(), which warns whenever a runnable task drops to a lower scheduling class without the SCX_OPS_ENQ_LAST flag set, assuming balance_one() would have kept it running. However, when core scheduling is enabled, a forced-idle SMT sibling reschedules via the core_pick fast path in pick_next_task(), which bypasses pick_task_scx() and thus balance_one() — allowing a runnable task to legitimately drop to idle without ENQ_LAST being set. The fix gates the warning on sched_cpu_cookie_match(): a cookie mismatch indicates core scheduling forced the idle state (suppressing the warning), while a match or disabled core scheduling still catches genuine missing-ENQ_LAST drops. No CWE classification has been formally assigned (GitHub Advisory).

A local user can trigger false kernel warning messages in the scheduler by repeatedly manipulating core scheduling state, potentially causing log flooding and scheduler instability on systems with SMT (Simultaneous Multi-Threading) and core scheduling enabled. The primary impact is availability — specifically denial of service through log flooding or scheduler disruption — with no direct confidentiality or integrity impact identified. The vulnerability is limited to local access and does not enable privilege escalation or remote code execution (Feedly).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the disclosure date. The vulnerability requires local access to a system running Linux kernel 6.12 or later with core scheduling (SMT) enabled. No threat actor attribution, CISA KEV listing, or exploit kit involvement has been reported. The EPSS score is 0.0, reflecting very low exploitation probability (GitHub Advisory, Feedly).

Update the Linux kernel to a patched version: 6.18.42 (for the 6.18.x stable branch), 7.1.6 (for the 7.1.x stable branch), or 7.2-rc4 and later. The corresponding fix commits are 2907e9d0f05b506dfd58aec589a23042a56ef36b, e2f188cdbf8312289532c36eb4e9eb1c9544d43a, and b7d9c359e5cf867f7eb23df3bb1c6b9e58af24da. Systems using core scheduling (SMT sibling isolation) should be prioritized for patching to prevent log flooding and potential scheduler instability. As a temporary workaround, disabling core scheduling (/sys/kernel/debug/sched/core_sched) on affected systems may reduce exposure, though upgrading is the recommended solution (GitHub Advisory).