CVE-2026-31734

Vulnerability

A false negative in the is_bpf_migration_disabled() check within the Linux kernel's sched_ext subsystem could allow a migration-disabled task to be incorrectly considered as migratable. The root cause lies in the interaction with the BPF trampoline prolog: since commit 8e4f0b1ebcf2 ("bpf: use rcu_read_lock_dont_migrate() for trampoline.c"), the BPF prolog calls migrate_disable() only when CONFIG_PREEMPT_RCU is enabled. Without CONFIG_PREEMPT_RCU, migration_disabled == 1 always indicates true migration-disabled status, but the old code unconditionally checked p == current, creating a false negative on non-PREEMPT_RCU configurations [1].

Exploitation

An attacker with local access and the ability to trigger scheduler operations could potentially leverage this bug to cause a migration-disabled task to be dispatched to a remote CPU. The vulnerability is triggered during scheduler decisions in task_can_run_on_remote_rq(), which may incorrectly allow a task that should not be migrated to be moved [1].

Impact

Successful exploitation could lead to a scx_error in task_can_run_on_remote_rq(), potentially causing system instability or denial of service. The impact is limited to systems running the sched_ext scheduler extension with BPF programs, and only on kernels built without CONFIG_PREEMPT_RCU [1].

Mitigation

The fix, applied in Linux kernel stable commits, ensures that the p == current disambiguation is only used when CONFIG_PREEMPT_RCU is enabled, eliminating the false negative. Users should update to a patched kernel version containing commits such as the one referenced in [1].