Answer in brief
CVE-2026-74593 records a Unknown severity vulnerability in sched_ext: Take cgroup_lock() first in scx_cgroup_lock(). The current sources do not mark it as known exploited. The current feed maps Linux/Linux (generic), Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
A CVSS score is not reported in the current record. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps Linux/Linux (generic), Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| Linux/Linuxgeneric | >=a5bd6ba30b3364354269b81ac55c2edca9a96d6d <a054c9ffa9b7a0dffb763837b91ac9d381ec6d10 || >=a5bd6ba30b3364354269b81ac55c2edca9a96d6d <5f8b69642d18e1f3e11996707842ac530444e959 | a054c9ffa9b7a0dffb763837b91ac9d381ec6d10, 5f8b69642d18e1f3e11996707842ac530444e959 |
| Linux/Linuxgeneric | 6.18 | Not reported |
| Linux/Linuxgeneric | >=a5bd6ba30b3364354269b81ac55c2edca9a96d6d <2ca6b43edf83f8fc368cc3094ee5f3b1e8e0b0f0 || >=a5bd6ba30b3364354269b81ac55c2edca9a96d6d <a054c9ffa9b7a0dffb763837b91ac9d381ec6d10 || >=a5bd6ba30b3364354269b81ac55c2edca9a96d6d <5f8b69642d18e1f3e11996707842ac530444e959 | 2ca6b43edf83f8fc368cc3094ee5f3b1e8e0b0f0, a054c9ffa9b7a0dffb763837b91ac9d381ec6d10, 5f8b69642d18e1f3e11996707842ac530444e959 |
Published upstream
Aug 22, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Aug 23, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Aug 22, 2026
In the Linux kernel, the following vulnerability has been resolved: sched_ext: Take cgroup_lock() first in scx_cgroup_lock() scx_cgroup_lock() write-locks scx_cgroup_ops_rwsem and then takes cgroup_lock(), which can deadlock through kernfs: scx enable/disable cgroup rmdir cpu.weight write ------------------ ------------ ---------------- cgroup_lock() percpu_down_write(rwsem) cgroup_lock() kernfs_get_active() percpu_down_read(rwsem) kernfs_drain() The enable path waits for the rmdir to release cgroup_mutex. The rmdir, deactivating the cpu controller's files, waits in kernfs_drain() for the write's active reference. The write, in scx_group_set_weight(), waits for the rwsem behind the pending writer. Take cgroup_lock() first. The set_* paths take no cgroup locks inside the read side, so a pending write-lock then only waits for read sections that always run to completion, and no dependency from the rwsem back to cgroup_mutex remains.
Quoted source text, attributed separately from HOL analysis.