LiveActive security incident?Get immediate response
CVE Record

CVE-2025-39780: sched/ext: Fix invalid task state transitions on class switch

In the Linux kernel, the following vulnerability has been resolved: sched/ext: Fix invalid task state transitions on class switch When enabling a sched_ext scheduler, we may trigger invalid task state transitions, resulting in warnings like the following (which can be easily reproduced by running the hotplug selftest in a loop): sched_ext: Invalid task state transition 0 -> 3 for fish[770] WARNING: CPU: 18 PID: 787 at kernel/sched/ext.c:3862 scx_set_task_state+0x7c/0xc0 ... RIP: 0010:scx_set_task_state+0x7c/0xc0 ... Call Trace: <TASK> scx_enable_task+0x11f/0x2e0 switching_to_scx+0x24/0x110 scx_enable.isra.0+0xd14/0x13d0 bpf_struct_ops_link_create+0x136/0x1a0 __sys_bpf+0x1edd/0x2c30 __x64_sys_bpf+0x21/0x30 do_syscall_64+0xbb/0x370 entry_SYSCALL_64_after_hwframe+0x77/0x7f This happens because we skip initialization for tasks that are already dead (with their usage counter set to zero), but we don't exclude them during the scheduling class transition phase. Fix this by also skipping dead tasks during class swiching, preventing invalid task state transitions.

HighCVSS 7.8Not KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysishigh

Security readout for executives and security teams

Plain-English summary

A Linux scheduler flaw can cause invalid task-state changes when enabling a sched_ext scheduler. The supplied record rates it high severity, but the documented symptom is a kernel warning during scheduler switching. Exact real-world security impact is not demonstrated in the bundle.

Executive priority

Prioritize affected multi-user or workload-orchestration systems using sched_ext. Remediation should follow the normal high-severity kernel-update process, but emergency incident response is not justified by the supplied exploitation evidence alone.

Technical view

Dead tasks with a zero usage counter were skipped during sched_ext initialization but not excluded from the scheduling-class transition. This inconsistency could pass those tasks through an invalid state change. The referenced kernel commits fix the issue by also skipping dead tasks during class switching.

Likely exposure

Exposure is limited to Linux systems using affected kernels where sched_ext schedulers can be enabled. The CVSS vector describes a local, low-privilege attack path without user interaction; it is not remotely exploitable. The supplied version data appears flattened, so exact affected ranges require vendor confirmation.

Exploitation context

CISA KEV status is false, and the bundle provides no evidence of active exploitation or a weaponized exploit. It reports easy reproduction by repeatedly running the hotplug selftest, but that demonstrates the faulty transition rather than confirmed security compromise.

Researcher notes

The CVSS 3.1 score is 7.8 with local access and high confidentiality, integrity, and availability impacts. However, the narrative only documents warnings from invalid transitions and supplies no demonstrated compromise mechanism, CWE, or exploit evidence. Exact version boundaries and practical impact need vendor clarification.

Mitigation direction

  • Apply a vendor-supported kernel update incorporating the applicable referenced stable fix.
  • Check distribution or kernel-vendor guidance for exact fixed builds and backports.
  • Until updated, avoid enabling sched_ext where operationally feasible and vendor-supported.

Validation and detection

  • Inventory running kernel versions on systems that enable or permit sched_ext.
  • Compare vendor packages and backports with the three referenced stable commits.
  • Review kernel logs for sched_ext invalid task-state warnings during scheduler activation.
  • Confirm the updated kernel is running after installation and any required reboot.
  • Repeat relevant selftests in a non-production environment and confirm the warning is absent.
Prepared
Confidence
medium
Sources
5

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2025-39780 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
High
CVSS
7.8 (3.1)
Known Exploited
No
Published

Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

1CVSS vectors
3Timeline events
0ADP providers
4Source links

CVSS vector scores

1 official score

We collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.

ScoreVersionSeverityVectorExploitImpactSource
7.8CVSS 3.1HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H1.85.9Linux

Vulnerability scoring details

Base CVSS 3.1 score

7.8High
CVSS 3.1 vector shape for CVE-2025-39780Attack VectorAttack ComplexityPrivileges RequiredUser InteractionScopeConfidentiality ImpactIntegrity ImpactAvailability Impact

Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector
NetworkAdjacentLocalPhysical
Attack Complexity
LowHigh
Privileges Required
NoneLowHigh
User Interaction
NoneRequired
Scope
ChangedUnchanged
Confidentiality Impact
HighLowNone
Integrity Impact
HighLowNone
Availability Impact
HighLowNone

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinuxa8532fac7b5d27b8d62008a89593dccb6f9786ef, a8532fac7b5d27b8d62008a89593dccb6f9786ef, a8532fac7b5d27b8d62008a89593dccb6f9786efunaffected
LinuxLinux6.12, 0, 6.12.44, 6.16.4, 6.17affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.