Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%
Buy Us a Coffee

CVE-2026-53328— sched_ext: Don't warn on NULL cgrp_moving_from in scx_cgroup_move_task()

AI Predicted 5.3 Difficulty: Trivial EPSS 0.17% · P6

Possible ATT&CK Techniques 1AI

T1053 · Scheduled Task/Job

Affected Version Matrix 10

VendorProductVersion RangeStatus
LinuxLinux8195136669661fdfe54e9a8923c33b31c92fc1da< cdff2eb97be147d2ce52ac1327841068781f25dcaffected
8195136669661fdfe54e9a8923c33b31c92fc1da< 0ffcad63b19a1cadb475c9f405a93607fdcd0d7caffected
8195136669661fdfe54e9a8923c33b31c92fc1da< bc75f5951fac4e49d175c4433fc08fb1ec01172faffected
8195136669661fdfe54e9a8923c33b31c92fc1da< 02e545c4297a26dbbc41df81b831e7f605bcd306affected
6.12affected
< 6.12unaffected
6.12.94≤ 6.12.*unaffected
6.18.36≤ 6.18.*unaffected
… +2 more rows
Get alerts for future matching vulnerabilitiesLog in to subscribe

I. Basic Information for CVE-2026-53328

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
sched_ext: Don't warn on NULL cgrp_moving_from in scx_cgroup_move_task()
Source: NVD (National Vulnerability Database)
Vulnerability Description
In the Linux kernel, the following vulnerability has been resolved: sched_ext: Don't warn on NULL cgrp_moving_from in scx_cgroup_move_task() A WARN fires when systemd's user manager writes "+cpu +memory +pids" to its own subtree_control while a sched_ext scheduler is loaded: WARNING: at kernel/sched/ext.c:3227 scx_cgroup_move_task+0xa8/0xb0 scx_cgroup_move_task+0xa8/0xb0 sched_move_task+0x134/0x290 cpu_cgroup_attach+0x39/0x70 cgroup_migrate_execute+0x37d/0x450 cgroup_update_dfl_csses+0x1e3/0x270 cgroup_subtree_control_write+0x3e7/0x440 scx_cgroup_can_attach() arms cgrp_moving_from only when a task's cpu cgroup changes. It can still be NULL when scx_cgroup_move_task() runs, through this sequence: Step Result --------------------------------- ---------------------------------- 1. cpu enabled on cgroup G cpu css = A 2. cpu toggled off then on for G A killed, B created (same cgroup) 3. an exiting task keeps A alive migration skips it, A now stale 4. +memory migrates G stale A vs current B pulls cpu in 5. cpu attach runs for all tasks hits a live, cpu-unchanged task 6. scx_cgroup_move_task() on it cgrp_moving_from NULL -> WARN The mismatch is that scx_cgroup_can_attach() keys on cgroup identity while migration drives the move on css identity, so a NULL cgrp_moving_from here is a legitimate css-only migration, not a missing prep. The call is already gated on cgrp_moving_from, so just drop the warning. ops.cgroup_prep_move() and ops.cgroup_move() stay paired.
Source: NVD (National Vulnerability Database)
CVSS Information
N/A
Source: NVD (National Vulnerability Database)
Vulnerability Type
N/A
Source: NVD (National Vulnerability Database)
Vulnerability Title
Linux kernel 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Linux kernel是美国Linux基金会开源的一款操作系统内核。 Linux kernel 6.12版本存在安全漏洞，该漏洞源于在scx_cgroup_move_task()函数中对NULL cgrp_moving_from的处理不当，可能导致系统发出警告。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

VendorProductAffected VersionsCPESubscribe
LinuxLinux 8195136669661fdfe54e9a8923c33b31c92fc1da ~ cdff2eb97be147d2ce52ac1327841068781f25dc -
LinuxLinux 6.12 -

II. Public POCs for CVE-2026-53328

#POC DescriptionSource LinkShenlong Link
AI-Generated POCPremium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-53328

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-53328 (4)

Same Patch Batch · Linux · 2026-07-01 · 31 CVEs total

CVE-2026-533559.8 CRITICALnet: rds: clear i_sends on setup unwind
CVE-2026-533548.8 HIGHarm64: errata: Mitigate TLBI errata on various Arm CPUs
CVE-2026-533567.8 HIGHdrm/i915/gem: Fix phys BO pread/pwrite with offset
CVE-2026-533417.8 HIGHfhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh()
CVE-2026-533297.0 HIGHdrm/amd/display: Use krealloc_array() in dal_vector_reserve()
CVE-2026-53342arm64: mm: call pagetable dtor when freeing hot-removed page tables
CVE-2026-53353hsr: Remove WARN_ONCE() in hsr_addr_is_self().
CVE-2026-53352signal: clear JOBCTL_PENDING_MASK for caller in zap_other_threads()
CVE-2026-53351riscv/ptrace: Use USER_REGSET_NOTE_TYPE for REGSET_CFI
CVE-2026-53350ASoC: wm_adsp: Fix NULL dereference when removing firmware controls
CVE-2026-53348ASoC: SDCA: fix NULL pointer dereference in sdca_dev_unregister_functions
CVE-2026-53349netfilter: nf_conntrack: destroy stale expectfn expectations on unregister
CVE-2026-53346rust: arm64: set uwtable llvm module flag for CONFIG_UNWIND_TABLES
CVE-2026-53347drm/virtio: Fix driver removal with disabled KMS
CVE-2026-53344pinctrl: mcp23s08: Initialize mcp->dev and mcp->addr before regmap init
CVE-2026-53345KVM: Don't WARN if memory is dirtied without a vCPU when the VM is dying
CVE-2026-53343ARM: 9475/1: entry: use byte load for KASAN VMAP stack shadow
CVE-2026-53327debugobjects: Do not fill_pool() if pi_blocked_on
CVE-2026-53340i2c: imx: fix clock and pinctrl state inconsistency in runtime PM
CVE-2026-53339i2c: qcom-cci: Fix NULL pointer dereference in cci_remove()

Showing top 20 of 31 CVEs. View all on vendor page &rarr; →

IV. Related Vulnerabilities

Same product: Linux
Same vendor: Linux

V. Comments for CVE-2026-53328

No comments yet

Leave a comment