CVE-2025-40260

Root

Cause

The vulnerability is a bug in the Linux kernel's sched_ext subsystem, where the function scx_alloc_and_add_sched() fails to properly handle errors from kthread_run_worker(). The function returns an ERR_PTR on failure, but the code only checks for NULL, leading to a crash when an error pointer is dereferenced in scx_enable().

Exploitation

Prerequisites

No special prerequisites are required; the crash can be triggered by sending a SIGQUIT signal to the sched_ext selftests runner while test 15 is running. This causes the helper kthread creation to fail, and the kernel then attempts to dereference the invalid error pointer, resulting in a system crash.

Impact

An attacker with the ability to trigger the crash (e.g., by sending SIGQUIT from within a container or user namespace where sched_ext is in use) can cause a denial of service via kernel panic. The crash trace shows a dereference at scx_enable.constprop.0+0x358/0x12b0 [1].

Mitigation

The fix is included in commit [1] upstream, which changes the error handling to propagate the error via PTR_ERR(), allowing scx_enable() to jump to the existing error path instead of dereferencing an invalid pointer. Users should update to a kernel containing this patch.