---
id: CVE-2026-74593
title: |-
  In the Linux kernel, the following vulnerability has been resolved:

  sched_ext: Take cgroup_lock() first in scx_cgroup_lock()

  scx_cgroup_lock() write-locks scx_cgroup_ops_rwsem and then takes
  cgroup_lock(), which can deadlock through ke…
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  sched_ext: Take cgroup_lock() first in scx_cgroup_lock()

  scx_cgroup_lock() write-locks scx_cgroup_ops_rwsem and then takes
  cgroup_lock(), which can deadlock through ke…
severity: none
published: '2026-08-22'
updated: '2026-08-22'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-74593'
references:
  - url: 'https://git.kernel.org/stable/c/5f8b69642d18e1f3e11996707842ac530444e959'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/a054c9ffa9b7a0dffb763837b91ac9d381ec6d10'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
tags:
  - nvd
ingestedAt: '2026-08-23T06:43:33.828Z'
epss: 0.00206
epssPercentile: 0.09542
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

sched_ext: Take cgroup_lock() first in scx_cgroup_lock()

scx_cgroup_lock() write-locks scx_cgroup_ops_rwsem and then takes
cgroup_lock(), which can deadlock through kernfs:

  scx enable/disable         cgroup rmdir           cpu.weight write
  ------------------         ------------           ----------------
                             cgroup_lock()
  percpu_down_write(rwsem)
  cgroup_lock()
                                                    kernfs_get_active()
                                                    percpu_down_read(rwsem)
                             kernfs_drain()

The enable path waits for the rmdir to release cgroup_mutex. The rmdir,
deactivating the cpu controller's files, waits in kernfs_drain() for the
write's active reference. The write, in scx_group_set_weight(), waits for
the rwsem behind the pending writer.

Take cgroup_lock() first. The set_* paths take no cgroup locks inside the
read side, so a pending write-lock then only waits for read sections that
always run to completion, and no dependency from the rwsem back to
cgroup_mutex remains.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.